#security ยท Faiz Ahmed FarooquiPosts tagged security.https://faizahmed.in/AI Agents Are Running Real Attacks: Which of Your Controls Break Firsthttps://faizahmed.in/ai-agent-attacks-which-controls-break/https://faizahmed.in/ai-agent-attacks-which-controls-break/Fri, 21 Aug 2026 12:30:00 GMTaisecurityai-agentsthreat-modelingbackend-engineeringKey Rotation Without Downtime: Never Generate a Key in a Migrationhttps://faizahmed.in/jwt-key-rotation-without-downtime/https://faizahmed.in/jwt-key-rotation-without-downtime/Fri, 21 Aug 2026 04:00:00 GMTpostgresqlkey-managementjwkssecuritynodejsAppend-Only Audit Logs in Postgres: Your Trigger Misses TRUNCATEhttps://faizahmed.in/append-only-audit-log-postgres-hash-chain/https://faizahmed.in/append-only-audit-log-postgres-hash-chain/Thu, 20 Aug 2026 10:00:00 GMTpostgresqlaudit-logsecuritycompliancenodejsNested JWTs in Node.js: Decrypting a Token Is Not Verifying Ithttps://faizahmed.in/nested-jwts-nodejs-decrypt-is-not-verify/https://faizahmed.in/nested-jwts-nodejs-decrypt-is-not-verify/Tue, 11 Aug 2026 09:30:00 GMTjwtjwejosenodejsnestjssecuritySecuring LLM API Keys with AWS KMShttps://faizahmed.in/securing-llm-api-keys-aws-kms/https://faizahmed.in/securing-llm-api-keys-aws-kms/Wed, 08 Jul 2026 00:00:00 GMTai-engineeringawskmssecurityPrompt Injection: A Threat Model for LLM Appshttps://faizahmed.in/prompt-injection-threat-model-llm-apps/https://faizahmed.in/prompt-injection-threat-model-llm-apps/Sun, 05 Jul 2026 00:00:00 GMTai-engineeringsecurityllmRow-Level Security for Multi-Tenant SaaS in Postgreshttps://faizahmed.in/row-level-security-multi-tenant-saas-postgres/https://faizahmed.in/row-level-security-multi-tenant-saas-postgres/Wed, 01 Jul 2026 00:00:00 GMTpostgresqlmulti-tenancysecuritynodejsDesigning Webhooks: Delivery, Retries, Signatureshttps://faizahmed.in/designing-webhooks-delivery-retries-signature-verification/https://faizahmed.in/designing-webhooks-delivery-retries-signature-verification/Sun, 28 Jun 2026 00:00:00 GMTwebhooksfintechnodejsreliabilitysecurityOAuth 2.0 and OIDC: A Backend Engineer's Guide to Loginhttps://faizahmed.in/oauth2-oidc-backend-engineers-guide/https://faizahmed.in/oauth2-oidc-backend-engineers-guide/Fri, 26 Jun 2026 10:00:00 GMTsecurityauthenticationoauthoidcPasskeys and WebAuthn: How Passwordless Login Actually Workshttps://faizahmed.in/passkeys-webauthn-how-passwordless-login-works/https://faizahmed.in/passkeys-webauthn-how-passwordless-login-works/Thu, 25 Jun 2026 10:00:00 GMTsecurityauthenticationcryptographywebauthnUsing AI Without Leaking Your Secrets: A Threat Model for AI-Assisted Developmenthttps://faizahmed.in/using-ai-without-leaking-secrets/https://faizahmed.in/using-ai-without-leaking-secrets/Tue, 23 Jun 2026 10:00:00 GMTaisecuritynodejsawssecretsLoading Secrets at Runtime Without Leaking Them: config(), the Keystore, and runhttps://faizahmed.in/secret-keystore-runtime-config-loader-nodejs/https://faizahmed.in/secret-keystore-runtime-config-loader-nodejs/Fri, 12 Jun 2026 13:17:21 GMTawsnodejssecuritydevopsbackendEncrypt Your .env with One Command: The secret-keystore CLIhttps://faizahmed.in/secret-keystore-cli-encrypt-env-aws-kms/https://faizahmed.in/secret-keystore-cli-encrypt-env-aws-kms/Fri, 12 Jun 2026 12:59:34 GMTawssecuritynodejsbackenddevopsYour .env Is a Loaded Gun: A Saner Threat Model for Node.js Secretshttps://faizahmed.in/nodejs-secrets-threat-model-aws-kms/https://faizahmed.in/nodejs-secrets-threat-model-aws-kms/Fri, 12 Jun 2026 11:31:09 GMTsecurityawsnodejsbackenddevopsEncrypted .env for Node.js with AWS KMS: The Complete Guidehttps://faizahmed.in/encrypted-env-aws-kms-nodejs-complete-guide/https://faizahmed.in/encrypted-env-aws-kms-nodejs-complete-guide/Fri, 12 Jun 2026 11:24:08 GMTsecurityawsnodejsdevopsbackendStop Putting Secrets in process.env: Encrypt Env Vars with AWS KMShttps://faizahmed.in/secret-keystore/https://faizahmed.in/secret-keystore/Sat, 21 Feb 2026 19:30:57 GMTsecurityawsattestationnodejsnextjsnestjsdevopscloudbackendSecrets Sprawl in Node.js Projects: Detection, Prevention & Secure Deployment (2025)https://faizahmed.in/secrets-sprawl-in-nodejs-projects-detection-prevention-and-secure-deployment-2025/https://faizahmed.in/secrets-sprawl-in-nodejs-projects-detection-prevention-and-secure-deployment-2025/Tue, 05 Aug 2025 08:07:20 GMTnodejssecrets-managementgitguardiandevsecopsci-cdbackend-engineeringcloud-securitysoftware-engineeringsecurityHow to Prevent Replay Attacks with JWTs: JWS vs JWE and Fingerprint Validation in Node.jshttps://faizahmed.in/how-to-prevent-replay-attacks-with-jwts-jws-vs-jwe-and-fingerprint-validation-in-nodejs/https://faizahmed.in/how-to-prevent-replay-attacks-with-jwts-jws-vs-jwe-and-fingerprint-validation-in-nodejs/Fri, 06 Jun 2025 13:27:47 GMTnodejsjwtsecurityauthenticationbackendbackend-engineeringwebsecurityreplay-attackdevtipsexpressJWT vs JWS vs JWE (and JWKS): A Developer's Guidehttps://faizahmed.in/jwt-jwe-and-jwks-explained-a-developers-guide-to-token-based-security/https://faizahmed.in/jwt-jwe-and-jwks-explained-a-developers-guide-to-token-based-security/Thu, 27 Mar 2025 12:30:46 GMTjwtjwejwkstokensecurity