SnapSave_App_984588367476638_1440p

May 15, 2026 20:44 · 5:29 · English · Whisper Turbo · 2 Wasemaji
Rekodi hiyo yamalizika leo. Kufugwa kwa ajili ya uhifadhi wa kudumu →
Index YA TAA
Kuonyesha tu
0:00
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
In this video, we're going to go through 10 real -world application security mistakes
0:04
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
developers commonly make.
0:05
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Let's start with the first one,
0:06
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
trusting the front end.
0:07
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
A lot of times,
0:08
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
we hide features in the UI,
0:10
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
like an admin button,
0:11
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
and assume only admins can access it.
0:13
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
But here's the problem.
0:14
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Attackers don't use your UI.
0:16
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
They directly interact with your backend by sending requests on their own.
0:20
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
So even if something is hidden in the front end,
0:22
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
if your back end is not validating properly,
0:24
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
any user can still access that functionality.
0:26
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
So hiding something is not security.
0:28
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
The back end must always verify who the user is and what they're allowed to
0:33
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
do. That's why trusting the front end alone is never enough.
0:35
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Next is broken access control.
0:38
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
This is one of the most common vulnerabilities.
0:40
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
It simply means users are able to do things they shouldn't be allowed to do.
0:44
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
For example, a normal user trying to perform an admin -level action like deleting
0:48
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
another user,
0:49
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
and it actually works.
0:50
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
That means the system is not properly checking permissions.
0:53
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
This can lead to serious issues like deleting data,
0:56
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
modifying other users,
0:57
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
accessing admin features.
0:58
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Another very common mistake is not enforcing proper access control.
1:02
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
There are three ways this usually breaks.
1:04
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Users performing actions they shouldn't like deleting data.
1:07
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Users accessing data they shouldn't like other users' info.
1:11
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
users modifying fields they shouldn't,
1:13
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
like roles or pricing.
1:14
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
So always validate who is making the request,
1:17
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
what action they are trying to perform,
1:19
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
and on which resource.
1:20
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
And if this validation is missing,
1:21
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
your entire system becomes exposed.
1:23
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
The third one is business logic abuse.
1:26
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
This is a bit different.
1:26
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Here, the issue is not in a single API,
1:29
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
but in the overall flow of the application.
1:31
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Every app has a process.
1:33
S… Speaker 2 (SnapSave_App_984588367476638_1440p)
For example,
1:33
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
think about a typical e -commerce website.
1:35
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
First, you add items to your cart,
1:37
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
then you make the payment,
1:38
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
and only after that,
1:39
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
you receive rewards.
1:40
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Now imagine someone skips the payment step and directly tries to claim the reward.
1:44
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
If your system allows that,
1:46
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
they get benefits without completing the process.
1:48
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
So technically everything works,
1:50
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
but the flow is broken.
1:51
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
you need to validate the entire user journey,
1:53
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
not just individual APIs.
1:55
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Because if the flow breaks,
1:56
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
the system can still be abused.
1:58
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Next is trusting external APIs.
2:01
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Modern applications depend heavily on external services like payments,
2:04
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
authentication,
2:05
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
and data providers.
2:06
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
And because of that,
2:07
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
developers often start trusting these services completely.
2:10
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
But that's where the mistake happens.
2:11
S… Speaker 2 (SnapSave_App_984588367476638_1440p)
For example,
2:12
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
imagine your app depends on an external authentication service.
2:15
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
If you simply trust its response without verifying it on your side,
2:19
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
and that service gets compromised,
2:21
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
your system is also at risk.
2:22
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Because now,
2:23
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
attackers can send fake responses or tokens and your application might accept
2:27
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
them as valid.
2:27
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
So even when using external services,
2:29
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
you should never blindly trust them.
2:32
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Always validate responses and have your own security checks in place,
2:35
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
because your security should never fully depend on someone else.
2:38
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Now let's talk about SSRF,
2:40
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
server -side request forgery.
2:42
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
This happens when your server makes requests based on user input.
2:45
S… Speaker 2 (SnapSave_App_984588367476638_1440p)
For example,
2:46
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
you build a feature where a user provides a link,
2:48
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
and your server fetches data from it.
2:50
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
If you don't validate that input,
2:51
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
an attacker can provide internal server addresses,
2:54
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
admin endpoints,
2:55
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
or sensitive internal services.
2:56
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Instead of a normal website,
2:58
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
they might give something like your own internal admin system.
3:01
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Now your server is calling its own private services,
3:03
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
or even worse,
3:04
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
cloud metadata endpoints.
3:06
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
So in simple terms,
3:07
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
you're letting the user control what your server can access,
3:10
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
and that's dangerous.
3:11
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
And that's exactly why input to server -side requests must always be restricted.
3:15
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Next is security misconfiguration.
3:17
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
This is not about coding mistakes,
3:19
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
but about setup issues.
3:20
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Some common examples.
3:21
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Default usernames and passwords not changed.
3:24
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Debug mode enabled in production.
3:26
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Old or outdated software.
3:27
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Unnecessary services left running.
3:29
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Individually,
3:30
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
these may look small,
3:31
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
but together they create serious vulnerabilities.
3:33
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
This is like installing a security system and leaving the door open.
3:37
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
So always make sure your environment is secure,
3:39
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
not just your code.
3:40
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Because even a secure application can fail in an insecure environment.
3:44
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Next is no API inventory.
3:47
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
This means you don't have a clear record of all the APIs in your system.
3:50
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Over time,
3:51
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
new APIs get added,
3:52
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
old ones are not removed,
3:54
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
test APIs might go live.
3:56
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Now imagine one old API that has no rate limiting.
3:59
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
That's all attackers need.
4:00
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Or one old API that has no proper security.
4:03
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
That becomes an easy entry point.
4:05
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
If you don't know what APIs exist,
4:07
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
you can't secure them.
4:08
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
So always maintain a proper inventory of your APIs,
4:11
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
because unknown APIs are often the easiest way in for attackers.
4:15
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Next is no rate limiting.
4:16
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
This is about controlling how many requests a user can make.
4:19
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
PIs without limits are dangerous.
4:21
S… Speaker 2 (SnapSave_App_984588367476638_1440p)
For example,
4:22
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
trying thousands or even millions of OTP combinations.
4:26
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Without rate limiting,
4:27
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
it might eventually work.
4:28
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Attackers can try multiple passwords,
4:30
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
brute force OTPs,
4:32
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
or send a huge number of requests.
4:34
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
So always limit requests to prevent abuse and protect your system.
4:37
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
because without limits,
4:38
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
attackers only need time to succeed.
4:40
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Next is no input validation.
4:42
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
This happens when user input is accepted without proper checks.
4:46
S… Speaker 2 (SnapSave_App_984588367476638_1440p)
For example,
4:46
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
a search field where a user is expected to type something normal.
4:50
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Instead, an attacker sends malicious commands.
4:52
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
If your backend executes it directly,
4:54
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
it can lead to data loss or system compromise.
4:57
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
So always validate and sanitize inputs before processing them.
5:00
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Treat all input as untrusted,
5:02
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
because trusting user input blindly can break your entire system.
5:06
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
The last one is exposing sensitive data.
5:08
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Sometimes the issue is not access,
5:10
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
but what your system returns.
5:12
S… Speaker 2 (SnapSave_App_984588367476638_1440p)
For example,
5:13
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
A PI response is containing passwords,
5:15
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
tokens,
5:16
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
personal data.
5:17
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Even if the request is valid,
5:18
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
this information should never be exposed.
5:20
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
Always return only the data that is necessary and protect sensitive information
5:25
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
properly, because once sensitive data is exposed,
5:27
S… Speaker 1 (SnapSave_App_984588367476638_1440p)
the damage is already done.

Nakala hii ilitokezwa na AI (utambuaji wa usemi wa kiaya). Inaweza kuwa na makosa Équipe dhidi ya sauti ya awali kwa utumizi wa kuchambua. Sera ya AI

Je, uwaambie marafiki wako kuhusu upendo wa STT.aiB!
Muhtasari
Bonyeza muhtasari ili kutokeza muhtasari wa AI juu ya nakala hii.
Kutoa muhtasari...
Uliza Maswali Kuhusu Mpito Huu
Uliza jambo lolote kuhusu nakala hii ya kitabu KULEA ile nitakayopata sehemu zinazofaa na majibu.
Trekta Nyingine