Secrets in Source Control: How to Find and Remove Them
By qc_admin
Why committed API keys and tokens are dangerous, regex patterns to hunt them down, why you must rotate first, and how to purge them from Git history.
Category: Security
How Password Hashing Actually Works
By qc_admin
Why you never store plaintext, why fast hashes like MD5 are wrong for passwords, and how salts and slow KDFs (bcrypt, scrypt, Argon2) protect them.
Why You Shouldn’t Paste Production Tokens Into Online Tools
By qc_admin
Pasting a live JWT or API key into a random online decoder can leak it to a server. How to tell if a tool is client-side, and why it matters.
Client-Side vs Server-Side: What Stays Private
By qc_admin
What “runs in the browser” really means, how to verify no data leaves your machine with the DevTools Network tab and CSP, and why client-side tools are safer for sensitive input.