https://hackyjs.com/posts/auditing-vite-dev-servers-for-env-exposure-via-fs-and-the-hmr-socket Hacky JS en 2026-09-15T00:00:00.000Z Auditing Vite Dev Servers for .env Exposure via /@fs and the HMR Socket vite, security, javascript, cloud-security, devsecops https://hackyjs.com/posts/reading-the-axios-npm-diff-how-a-postinstall-hook-turns-into-ci-rce Hacky JS en 2026-09-15T00:00:00.000Z Reading the Axios npm Diff: How a Postinstall Hook Turns Into CI RCE npm, supply-chain-security, ci-cd, javascript, rce https://hackyjs.com/posts/auditing-a-webauthn-login-flow-for-aitm-proxy-phishing-and-session-token-theft Hacky JS en 2026-09-14T00:00:00.000Z Auditing a WebAuthn Login Flow for AitM Proxy Phishing and Session Token Theft webauthn, passkeys, phishing, authentication, security https://hackyjs.com/posts/hardcoded-keys-in-react-native-bundles-scanning-your-own-artifacts-the-way-claude-scanned-18-million-apks Hacky JS en 2026-09-14T00:00:00.000Z Hardcoded Keys in React Native Bundles: Scanning Your Own Artifacts the Way Claude Scanned 1.8 Million APKs react-native, security, secret-scanning, appsec, mobile