OTaKuHP

SAST Tools

Curated list of security tools

💰 - Commercial Tool

Secrets Detection

Proactive

vncsna

set -e, -u, -o, -x pipefail

The set lines

• These lines deliberately cause your script to fail. Wait, what? Believe me, this is a good thing.
• With these settings, certain common errors will cause the script to immediately fail, explicitly and loudly. Otherwise, you can get hidden bugs that are discovered only when they blow up in production.

• set -euxo pipefail is short for:

set -e
set -u

sindresorhus

Pure ESM package

The package that linked you here is now pure ESM. It cannot be require()'d from CommonJS.

This means you have the following choices:

1. Use ESM yourself. (preferred)
   Use import foo from 'foo' instead of const foo = require('foo') to import the package. You also need to put "type": "module" in your package.json and more. Follow the below guide.
2. If the package is used in an async context, you could use await import(…) from CommonJS instead of require(…).
3. Stay on the existing version of the package until you can move to ESM.

maelvls

Dealing with secrets

GNOME comes with libsecret. You can use libsecret to store your git credentials:

sudo apt install libsecret-1-0 libsecret-1-dev libglib2.0-dev
sudo make --directory=/usr/share/doc/git/contrib/credential/libsecret
git config --global credential.helper /usr/share/doc/git/contrib/credential/libsecret/git-credential-libsecret

ejlp12

ECS Best Practices

• Understand and check Service Quota of ECS/Fargate and other related services
• Cluster
  • Use IaC for setting up resources eg. CloudFormation, AWS CDK, Terraform
    • Use copilot for simple setup
    • CloudFormation reference architecture template
      • https://github.com/nathanpeck/ecs-cloudformation
      • https://github.com/awslabs/aws-cloudformation-templates/tree/master/aws/services/ECS
• CDK for ECS: blog

Jiab77

Real-time PHP-FPM Status

This gist will explain you how to enable an undocumented feature of PHP-FPM which will give a real-time performance stats.

Everybody knows the famous phpinfo() and the page it generates, right? Then the real-time PHP-FPM status page design is very similar.

Some informations from the top are not displayed to avoid security issues.

Enable PHP-FPM Status

pepeloper

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\JsonResponse;

class ProfileJsonResponse
{
    /**

joshbuchea

Semantic Commit Messages

See how a minor change to your commit message style can make you a better programmer.

Format: <type>(<scope>): <subject>

<scope> is optional

Example

Jeff-Russ

PHP's Numeric & String Key Type Juggling

Arrays in PHP treat integer and string integers synonymously. If you set $a['1'] = '1' and access $a[1] you will get '1'. This is because php juggled your string key to an integer before assigning it; the assigment was actually made to an integer key. PHP also juggles in the process of accesssing too which means if you try to access [1] with ['1'] it will work. Therefore there is no real distinction between string integers and real integer, you can use them interchangably.

Remember that '1.0' does not equal '1' or 1 with strict comparison. This is true of array keys as well: you can have both ['1.0'] and ['1'] and they would be different elements but not [1] and ['1'].

RuGa

/**
* Mass (bulk) insert or update on duplicate for Laravel 4/5
* 
* insertOrUpdate([
*   ['id'=>1,'value'=>10],
*   ['id'=>2,'value'=>60]
* ]);
* 
*
* @param array $rows