Tag
security
2 notes.
__debugInfo() does not hide anything from dd()
The card object in my Laravel package kept its number in a private property, masked it in __debugInfo(), and marked the constructor arguments #[SensitiveParameter]. dd() printed the full card number and CVN anyway, and so did var_export() and an (array) cast. The fix was to stop storing them on the object at all.
Never run django.template.Template() on HTML you didn’t write
A single stored record took an endpoint down for a week. It contained valid, working markup for a different template language. Django compiled it anyway, because that is what you asked it to do.