Notes

Home

  1. Claude Code Exposes Thousands of Secrets on GitHub

    A security investigation by Apiiro has uncovered thousands of exposed credentials linked to Anthropic’s Claude Code. The issue stems from the “Yes, and don’t ask again” permission feature, which can store complete shell commands in .claude/settings.local.json. When these commands contain hardcoded passwords, API keys, or database credentials, sensitive data may end up in public GitHub […]

  2. Windows Paint Has a Security Fix, but You Won’t Find It in Windows Update

    Microsoft has quietly patched a serious security hole in Paint, the drawing app that ships with Windows. The fix, however, doesn’t arrive through the usual Windows Update channel — users need to grab it from the Microsoft Store instead. The vulnerability, tracked as CVE-2026-83844, could let an attacker execute code remotely, earning it an “Important” […]

  3. Deploying ModSecurity WAF in Front of IIS Using Nginx

    Adding a WAF to an existing IIS infrastructure doesn’t necessarily require changing the web servers or applications. In this setup, an Ubuntu server running Nginx, ModSecurity v3, and OWASP Core Rule Set (CRS) was deployed between the firewall and internal IIS servers. Architecture The firewall forwards incoming web traffic to the Nginx gateway. Nginx uses […]