AppSec, fraud, risk and platform security.
There’s a version of a security operations centre that exists mainly to be pointed at. It ingests every log it can reach, lights up a wall of dashboards, and staffs a rotation around the clock so that, if anyone asks, the answer is “yes, someone is watching.” It satisfies an…
3DS vs 3DS2 explained: risk-based authentication, frictionless flow, global mandates in the EU, India, Japan & Australia, and what changed after 3DS1's sunset
TrustMeshDownload to access the paperTRUST.pdf1 MBdownload-circle Every day, millions of Cash-on-Delivery orders flow through Meesho. The vast majority are legitimate: a first-time buyer in Patna ordering a kurta, a reseller in Surat stocking up on inventory. But tucked inside…
Co-authors: Mahlaqahaque Mh, Keertiv, Hari Prasad Pujari How we taught AI to read code like a senior security engineer Every day, Razorpay engineers ship thousands of lines of code. Every line births new security findings. SAST scanners flag suspicious patterns. Dependency…
A seller ships the correct product. A buyer claims they didn't receive what they ordered. Both tell their truth. In the vast supply chain, where millions of packages move unseen, lies the issue that Meesho's Trust & Safety team works to address. The honest answer is that no…
Network tokenization vs PCI tokenization: how they differ at the architecture level, what each does to authorization rates, fraud, PCI scope, and vendor lock-in
A payment vault is a digital database that stores sensitive information like credit card, bank account details, etc.
3DS 2.0 is updated to deal with current challenges, while enhancing security, improving user experience, and reducing friction during online transactions.
Understand what a passkey is, how passkeys work, and why they’re replacing traditional passwords for secure, passwordless authentication. Learn more on Juspay's blog
A Story from the Frontlines of Threat Intelligence The identification of cyber threats in e-commerce is challenging because discussions on topics like gift cards and discounts, when found on underground forums, can signal fraud yet closely resemble normal customer behavior. For…
Contributor : Yashshree Shinde When merchants couldn’t see why their funds were on hold, trust broke down. Here’s how we rebuilt the entire experience. You’ve shipped your products, paid your delivery partners, and you’re waiting for settlement. Then you receive a notification:…
Postman recently rolled out Organizations, a new set of features designed to allow Enterprise plan customers to set up multiple Teams under...
Flipkart serves thousands of sponsored ads across various pages and with search queries. Advertisers are charged based on the impression views or clicks generated by their campaign content. In the high-velocity domain of AdTech, the latency between an ad impression/click and a…
We’ve all spent way too many years falling asleep to sitting through boring videos seemingly made in the 1900s–that you can’t speed...
Postman has joined Wiz’s Zero Critical Club, “a prestigious group of Wiz customers who have achieved the extraordinary feat of having zero...
Postman Security knows that trust begins with transparency. So we are following up (as promised!) on the Shai Halud attack we first...
APIs are the nervous system of modern software. They power apps, SaaS platforms, fintech products, and even your coffee machine. Yet, APIs...
Update: our RCA has been posted here. Postman has discovered unusual activity in our NPM org relating to the ongoing “Shai-Hulud 2.0...
In today’s rapidly evolving API landscape, security isn’t a box to check; it’s a dynamic, evolving strategy. At Postman, we’re not just...
Postman’s commitment to Product Security begins with our approach to Application Security. Every engineering team in Postman has an assigned Security Engineer...
At Postman, we serve millions of developers building, testing, and documenting APIs. As our platform scaled, so did the complexity of managing...
The Rising Tide of E-commerce Fraud We are deeply aligned with our aim to democratize our platform—with new entrepreneurs joining and logistics partners working across pin codes in India. This inclusivity is our biggest strength—and also the reason why we need to be extra…
In the rapidly evolving FinTech sector, PhonePe Private Limited, an India-born leader in financial services, stands out for its innovative range of products and services. Offering everything from UPI transactions and bill payments to stock market investments, personal finance…
Data Privacy & Security — Detecting & Encrypting PII 🎤 10x Engineering Tech Talks Ever wondered why PII encryption is crucial or how to effectively detect PII in your databases? In this insightful talk, Jatin Gupta (Tech Lead, Infra & Security) delves into the importance of PII…
Let’s explore how Hasura's domain-driven approach to GraphQL simplifies SDLC and enhances performance, scalability, and security.
In the previous part, we delved into the different steps of achieving isolation between the module sandbox and the host app during the development phase.
In the initial segment of this blog series, we explored the concepts of application and module sandboxing, identified scenarios that necessitate a module sandboxing solution, and highlighted its advantages.
Module Sandboxing is a fundamental concept that fortifies application security by isolating it from the underlying operating system and other applications.
We're excited to announce the Single Sign-on (SSO) solution for Hasura Console. You can integrate existing SSO identity providers (IdP) with Hasura GraphQL Enterprise Engine to enable authentication.
Within a few minutes, we replaced five different AWS components, implemented an API without writing a single line of code, added an admin secret for authentication, and added the ability to cache to provide low-latency data access.
To empower developers with more control over their data validation process, Hasura is thrilled to announce the launch of a powerful new feature – Input Validations!
Introducing Webhook Auth Caching – a big leap forward in optimizing the performance of webhook-based authentication mode, making it an even more powerful and efficient option for your authentication needs.
Hasura GraphQL Enterprise Edition has a host of upgraded capabilities, including security, observability, and performance enhancements, along with support for every enterprise database.
Learn how to generate allow lists in Hasura automatically from your GraphQL Queries.
Security note about a critical security vulnerability discovered in Hasura GraphQL Engine v2.10.0-v2.15 on Nov 21, 2021
This blog covers the basics of Postgres row-level security and the Hasura way of solving these permission rules.
A step by step tutorial for using Firebase to add authentication and authorization to a realtime Hasura app with a React Frontend.
Hasura has achieved certification to the International Organization for Standardization’s information security standard 27001. ISO 27001 standard is widely recognized international standard detailing best practices for the management of information security and privacy.
This article presents the benefits and drawbacks of using an Authentication Provider and compares the existing ones that support JWT integration.
Hasura Cloud added a security feature where you can timeout a GraphQL operation if it is taking more than configured time. We will look into more detail with example in this post.
JWTs are becoming a popular way of handling auth. This post aims to demystify what a JWT is, discuss its pros/cons and cover best practices in implementing JWT on the client-side, keeping security in mind.
We’re excited to announce some big updates to the Hasura GraphQL engine which further eliminate data silos, enhance security and lower the bar to universal GraphQL API usage.
— By Parag Suchak, Ritesh Kumar Web Application Firewall (WAF) is considered a critical part of an effective security solution that offers website security and strengthens the overall security posture. The end goal for any web application Firewall is to protect the application…
Hasura Cloud is now SOC 2 Type 2 certified, enabling more companies to place their critical workloads on Hasura Cloud and have the best of both enterprise security and first-class developer experience.
Hasura releases 8 new product updates at the monthly community call including support for new databases, GraphQL security & observability features, git-push to deploy, CLI support for ARM and enhancements to computed fields.
This document will outline Hasura’s security-first approach to running our own services, the security tooling we provide that allows our customers to pursue OWASP compliance and our commitment to achieving high marks according to the SAMM maturity model.
In this walkthrough, we're going to go through creating a simple GraphQL authentication service using Django Graphene, meshing it into your Hasura service, and creating a few sample requests.
In this tutorial, we will look at implementing a custom JWT solution with next-auth, served by Next.js and integrate the same with Hasura and make authenticated GraphQL API calls.