Field notes from the SSH Yazılım team on SAP, enterprise application development, integration and digitalization.
Container security for Java/Spring applications: non-root users, minimal base images, image scanning, secret management, read-only filesystems and deployment discipline.
Read the article →
Using JPA/Hibernate does not end SQL injection risk: a query discipline guide for concatenated JPQL, native queries, ORDER BY and LIKE patterns.
Read the article →
PCI DSS for e-commerce platforms: scope reduction strategies, tokenization and hosted payment fields, web skimming (Magecart) defense and the KVKK/GDPR intersection.
Read the article →
Lessons from Log4Shell, event-stream and dependency confusion: SBOM, lockfile discipline, CI scanning, version policy and defending the software supply chain.
Read the article →
JWT and OAuth 2.0 in API security: signature validation mistakes, algorithm confusion, token lifetimes and refresh rotation, PKCE and scope discipline — an implementation guide.
Read the article →
XSS in React projects: where JSX escaping protects you and where it does not, dangerouslySetInnerHTML and DOMPurify, URL-based vectors, CSP and the token storage decision.
Read the article →
The OWASP MASVS framework for mobile app security: secure data storage, TLS and certificate pinning, WebView risks, reverse engineering resilience and a pre-release verification checklist.
Read the article →
The OWASP Top 10 (2021) categories mapped to the Java/Spring world: a practical control map for access control, injection, misconfiguration, vulnerable dependencies and SSRF.
Read the article →
Security in SAP Commerce (Hybris) projects: HAC and Backoffice access restrictions, default account risks, OCC API protection, ImpEx scripting discipline and the SAP security note process.
Read the article →