Category Secure Scripting Practices (Shell/PowerShell)

When developers rush to finish code, they’ll grab those admin rights without thinking twice. You might as well hand over the keys to your house. Our training team’s seen this behavior hundreds of times – it’s like watching someone prop…

Most Windows admins can’t live without PowerShell scripts these days – remote management’s just too useful to ignore. But there’s a catch: without HTTPS protecting WinRM, it’s like leaving the keys in your car.  Last month our security team caught…

The chmod 777 trap catches everyone sooner or later. Each week in our secure coding bootcamp, there’s that moment when a frustrated student thinks giving full permissions will solve their access headache – it never does.  Just last month some…

Temp files lurk in nearly every developer’s code like landmines waiting to go off. Our training bootcamp saw it last month – a junior dev’s “temporary” cache sitting exposed on a shared server for weeks. Bad actors found it, grabbed…

Walking into any dev training room, you’ll spot them right away – those new coders bypassing PowerShell security like it’s some kind of game. Makes our security team cringe every time. It’s the digital equivalent of propping open the fire…

Any script without input checks is like a house with unlocked doors. Security teams see this mistake too often – automation tools accepting whatever data comes their way, no questions asked.  We’ve learned the hard way that secure scripting practices…

That naive practice of hardcoding database passwords into config files? We see it constantly in bootcamp – students dropping AWS keys right into their repos, only to get slammed with $5k bills from crypto miners who snatched those exposed credentials.…

Watching new developers stumble with shell script security happens more than you’d think. The answer’s pretty simple though – put quotes around those variables like “$var” to lock things down. We’ve learned that eval can bite back if it’s not…