Most security bugs in software happen when developers forget to follow well-known rules. Things like:
Use HTTPS so data is encrypted when it travels between users and servers.
Never store passwords as plain text — use secure, salted hashes like bcrypt or Argon2.
Use proper authentication — avoid exposing session tokens, and support two-factor login when you can.
Always validate user input — this helps stop attacks like SQL injection or XSS.
Check user permissions — never assume a user is allowed to see something without checking.
Don’t leak sensitive info — like credentials or stack traces in logs or responses.
Limit how often someone can try — to prevent brute-force attacks.
These are all examples of direct vulnerabilities — problems in the code that can be fixed by changing or adding lines.
But there’s another kind of vulnerability that’s much harder to catch — side-channel vulnerabilities.
These don’t happen because of a line of bad code, and they don’t leave logs behind. Instead, they leak information in indirect ways — like through how long something takes to run, or how big a…
