flawopen.com/Directory/Reference
Practical developer evaluations and answers to common framework security assumptions: ORM escape hatches, template escaping, authentication tokens, and agent sandbox boundaries.
How untrusted agent prompts compromise local desktop MCP tool daemons, path traversal escapes, and STDIO process confinement.
Why module-level singleton state leaks authenticated tenant sessions across consecutive requests, and AsyncLocalStorage isolation.
How hidden markdown comments in external PRs hijack internal copilot bots to exfiltrate AWS metadata tokens, and egress proxy hardening.
How untrusted web pages and emails subvert autonomous LLM agent execution and coerce unauthorized tool invocation.
How adversarial inputs persist into vector database embeddings and conversational memory to hijack future user sessions.
Architectural boundaries, least-privilege tool manifests, and cryptographic human-in-the-loop validation gates.
Why standard Docker is insufficient: gVisor user-space syscall interception, Firecracker microVMs, and zero-egress runtimes.
Public package registry precedence over internal enterprise packages and scoped namespace remediation.
Untrusted pull request title and body expressions inside inline bash steps and $GITHUB_ENV environment poisoning.
How mounting /var/run/docker.sock and granting CAP_SYS_ADMIN leads to instant root host compromise.
Is Android's addJavascriptInterface Safe?: Only when the WebView it's attached to never loads untrusted content. If it does, injec...
Is Angular Safe from XSS by Default?: Yes, for standard interpolation and property binding — Angular treats all values as untrusted by defau...
Is Content-Type Sniffing a Hidden XSS Risk?: Yes. If a server doesn't declare a strict content type, some browsers try to guess ("...
Do I Need a CSP If I Already Escape Output?: Yes — they're complementary, not redundant. Output encoding is the primary fix; CSP is a s...
Is a CSRF Token Required for GET Requests?: The real fix is different: a GET request should never perform a state-changing action in the fir...
CWE vs. CVE: What's the Difference?: CWE is the category — a type of bug, like "SQL Injection" (CWE-89). CVE is the instance ...
Is React's dangerouslySetInnerHTML Safe?: Only if the HTML string you pass it never contains untrusted content unsanitized. The name is...
Is Django's ORM Safe from SQL Injection?: Yes, for the query API you use 99% of the time — .filter(), .get(), .exclude(), and friends a...
Is Doctrine ORM Safe from SQL Injection?: Yes for DQL (Doctrine Query Language) with bound parameters and the QueryBuilder. Building a DQL o...
Is DOMPurify Enough to Make innerHTML Safe?: Yes, when it runs on the untrusted string immediately before assignment and is kept up to date....
Is Entity Framework's FromSqlRaw Safe?: Only if you pass values as separate parameters. Prefer FromSqlInterpolated instead — it accepts...
exec() vs execFile() in Node.js: What's the Difference?: exec() takes one string and runs it through a shell — shell features like pipe...
Learn how FastAPI handles data validation via Pydantic, when SQL injection can still occur with SQLAlchemy or raw databases, and how to prev...
Is fetch() Vulnerable to SSRF by Default?: If your server fetches a URL that a user gets to choose, and you don't restrict which URLs a...
Why Does Go Have Both text/template and html/template?: text/template generates plain text with no awareness of HTML — useful for config fil...
Is GORM's Raw() Method Safe?: Only when you pass placeholders and args separately. It executes exactly the query text you give it, with...
Is Escaping Quotes Enough to Prevent SQL Injection?: No — not reliably. Escaping is a mitigation applied after the fact; parameterized queri...
Is Using an ORM Enough to Prevent SQL Injection?: For its standard query API, yes. Every mainstream ORM also ships a raw-SQL escape hatch, a...
Is Java's ObjectInputStream Safe from Deserialization Attacks?: No — readObject() on untrusted data is one of the most well-documented ...
Is Java's Runtime.exec() Safe from Command Injection?: Safer than you'd expect by default — the single-string overload does its ow...
Is JSON.parse() Safe, or Can It Be Exploited Like eval()?: JSON.parse() is safe from the code-execution risk that older code using eval() to...
Architectural comparison of JWT in localStorage vs. HttpOnly SameSite cookies: XSS token theft, CSRF trade-offs, and recommended auth archit...
Is Knex.js Safe from SQL Injection?: Its query builder methods are safe by default. Its knex.raw() escape hatch is safe only when values are...
Is Markdown Rendering Safe from XSS?: Not automatically. Most markdown renderers pass raw HTML embedded in the markdown source straight thro...
MyBatis ${} vs #{}: Which One Is Safe?: #{value} is safe — it compiles to a bound JDBC parameter. ${value} is raw text substitution before t...
mysqli vs. PDO: Which Is Safer?: Neither is inherently safer — both are equally safe when used with prepared statements and bound parameters...
Learn how Next.js protects Server Actions against Cross-Site Request Forgery (CSRF), when protection applies, and edge-case vulnerabilities.
Is NHibernate Safe from SQL Injection?: Yes for HQL/Criteria queries with bound parameters. Building an HQL or native SQL string with interp...
Is Node's child_process.exec() Safe?: Not if the command string includes untrusted input — like Python's os.system(), exec() alway...
Learn how NoSQL injection works in MongoDB, how operator injection ($ne, $gt) bypasses authentication, and how to prevent it.
Why Is String Formatting Dangerous for Numeric IDs?: The risk was never about the value's real-world meaning — it's about the fact...
Is os.system() Always a Command Injection Risk?: It's risky whenever any part of the command string includes untrusted input — os.syste...
What Is a Parameterized Query?: A parameterized query is like filling out a form with labeled blanks instead of handwriting a whole letter. ...
Is path.join() Enough to Prevent Path Traversal?: No — a common misconception. path.join() normalizes path segments, but it doesn't sto...
Is Prisma's $queryRaw Safe?: $queryRaw (tagged template) is safe — Prisma auto-parameterizes each interpolated value. $queryRawUnsafe i...
Is Python's os.path.join() Safe from Path Traversal?: No, and there's a second Python-specific trap: if the second argument is an ...
Is Python's pickle.load() Safe on Untrusted Data?: No — and this isn't a subtle edge case. Python's own documentation states ...
Rails where() with String Interpolation: Is It Safe?: No. where("id = #{params[:id]}") is the single most common Rails SQL injecti...
Does SameSite=Strict Replace CSRF Tokens?: It closes most of the gap for modern browsers, but it's not a complete substitute — it depen...
An actionable engineering guide for safely running autonomous AI agents: Docker/gVisor sandboxing, disabling network egress, and human-in-th...
Is sequelize.query() Safe from SQL Injection?: Only when replacements are passed as a separate option. Sequelize's standard model metho...
Is SQLAlchemy's raw()/text() Safe?: Yes, when you use it with bound parameters. Unsafe the moment the SQL string itself is built with a...
Does sqlx's Compile-Time Checking Prevent SQL Injection?: It validates that a parameterized query's shape matches your real databa...
What Is SSRF and Why Do Cloud Metadata Endpoints Matter?: SSRF (Server-Side Request Forgery) is when an attacker tricks your server into mak...
Are Stored Procedures Immune to SQL Injection?: No — a common misconception. A stored procedure protects you only if it uses parameter bindi...
Is Python's subprocess.run(shell=True) Safe?: Not if any part of the command string includes untrusted input. shell=True runs the comma...
Is Svelte Safe from XSS by Default?: Yes, for standard {expression} output — Svelte escapes it automatically at compile time. {@html ...} is...
Is SVG Upload an XSS Risk?: Yes. SVG is an XML-based format that can contain embedded <script> tags and event-handler attribut...
Is TypeORM's Query Builder Safe?: Yes for standard repository methods and its parameterized QueryBuilder conditions. Its query() raw-SQ...
Is Vue's v-html Safe to Use?: Only if the HTML string is sanitized immediately before use. Vue's default {{ }} interpolation escap...
Is WKWebView loadHTMLString Safe for Untrusted Content?: No, not by itself — it renders exactly the HTML string it's given, script incl...
Reflected vs. Stored vs. DOM-Based XSS: All three are the same underlying bug — unescaped untrusted content reaching the page — but they dif...
What Is a Zip Slip Vulnerability?: A zip file's internal file list can include entries named things like ../../etc/cron.d/evil. If the ...