dev.to· Sep 17, 2026· by hamzezn

A stored-XSS report we couldn't quite reproduce, and hardened anyway

Open Original Article ↗
A researcher named Dhruv emailed us to report a stored XSS path: someone attaches a PDF with embedded...
🎯 Vulnerability: Cross-Site Scripting (XSS)
💡 Defense Fix: Enforce Context-Aware Output Encoding, strict Content-Security-Policy (CSP), and HttpOnly cookie flags.
#security#python#fastapi#webdev

More Writeups Like This

dev.to/tag/security

Asking Let's Encrypt when to renew: an ARI request built by hand in Python

by Jose Pollman
dev.to

Adding TOTP 2FA to your app the RFC way (Node.js and Python, no libraries)

by ragedpanda
dev.to/tag/security

Synapse Shield v0.9.8: Red-Teaming Our Rust + 1D-CNN Bot Mitigation Engine & Introducing Shadow Mode

by Mustafa Güngör
dev.to

How Many of a Scanner's Findings Are Real? Web-Vuln-Scanner's Detection Pipeline and False-Positive Control, Measured

by ezrazhao