Skill UI

A comprehensive guide detailing security best practices for integrating with Klaviyo. Learn how to manage private and public API keys, implement least-privilege scoping for different environments (Dev, Staging, Prod), and critically, how to verify webhook payloads using HMAC-SHA256 signatures. This guide is essential for developers building robust and secure marketing automation pipelines.

A comprehensive guide to setting up and processing Klaviyo webhooks. This skill covers creating webhook subscriptions via the API, implementing crucial HMAC-SHA256 signature verification for security, and building a robust event handler. Learn how to manage different topic types (e.g., profile updates, list changes) and ensure idempotency, making your application reliable for event-driven marketing integrations.

A comprehensive checklist designed to harden Linktree API integrations for high-concurrency, production-grade reliability. It covers critical aspects including secure secrets management, rate limit handling, robust error resilience (circuit breakers, exponential backoff), comprehensive monitoring setup, and advanced security practices like webhook signature verification. Use this guide to ensure link-in-bio analytics remain accurate and system uptime is maximized under viral traffic loads.

A comprehensive guide for developers implementing secure integrations with Lucidchart. Covers critical security measures including OAuth2 client credential management, webhook signature verification (HMAC-SHA256), API version pinning, robust access control, and data redaction for handling sensitive diagrams and proprietary data.

A comprehensive guide detailing best practices for securing MindTickle integrations. It covers critical technical requirements including using `Company-Id` for multi-tenant isolation, implementing HMAC-SHA256 verification for webhooks, strict SCIM payload validation, and PII redaction. Essential for developers ensuring compliance with GDPR and SOC2 standards when handling sensitive employee and HR data.

A comprehensive guide for developers implementing secure integrations with the Miro REST API v2. This guide covers critical security best practices, including OAuth 2.0 scope minimization, robust token lifecycle management (refreshing tokens), verifying webhooks using signatures, and implementing client secret rotation protocols. Essential for building reliable and secure SaaS applications connected to Miro.

A comprehensive checklist and methodology for penetration testing file upload endpoints. Covers critical vulnerabilities such as MIME type bypass, extension bypass, magic byte manipulation, path traversal, and stored XSS. Essential for web application security assessment and bug bounty hunting, guiding testers through basic testing to advanced exploitation techniques like Null Byte injection and double extensions.

A comprehensive checklist detailing advanced attack methodologies for JSON Web Tokens (JWT). Covers critical misconfigurations such as algorithm confusion (alg:none, RS256→HS256), weak secret brute forcing, header injection (kid, jku, jwk), cache poisoning, and improper validation. Also provides specific vectors for extracting JWTs from mobile environments (Android/iOS). Ideal for penetration testers conducting deep security assessments on authentication systems.

This comprehensive checklist guides thorough security testing of OAuth 2.0 and OpenID Connect (OIDC) protocols. It covers advanced vulnerabilities such as authorization code interception, PKCE bypass, CSRF flaws, and improper scope validation. The methodology emphasizes modern industry standards like FAPI (DPoP, JAR, PAR), making it essential for penetration testers and security researchers assessing web application integrity and API security.

This skill provides a comprehensive checklist and detailed methodology for detecting HTTP Request Smuggling vulnerabilities. It covers various desynchronization types (CL.TE, TE.CL, TE.TE), including HTTP/2 and modern variants. Use this when penetration testing multi-server architectures, proxies, or load balancers to identify potential security bypasses, unauthorized access, or cache poisoning risks.

A comprehensive guide to advanced SQL injection (SQLi) methodologies for offensive security assessments and bug bounty hunting. Covers all major injection types, including error-based, boolean/time-based blind, out-of-band, and second-order injection. Provides specific payloads and techniques for MySQL, MSSQL, PostgreSQL, Oracle, and NoSQL databases, along with methods for bypassing WAFs, exploiting GraphQL, WebSocket, and modern API filters. Includes full automation workflows using tools like sqlmap.

This comprehensive guide provides a detailed methodology for detecting and exploiting Server-Side Request Forgery (SSRF) vulnerabilities. It covers basic, blind, and out-of-band techniques, including testing against cloud metadata endpoints (AWS/GCP/Azure) and advanced bypass methods like DNS rebinding. It is an essential resource for web application security testing and bug bounty hunting.