Security on Daffa Abhipraya

PPL: Security, From App Code to Supply Chain [Sprint 2, Week 3]

Wed, 15 Apr 2026 00:00:00 +0700

What I Worked On

Two weeks of security work that span the whole stack. Week 1 (2-8 Apr) closed two OWASP A01 (Broken Access Control) gaps — one in our own code, one caught during a teammate’s code review — and added Sentry observability to Celery tasks so background job failures stop disappearing silently. Week 2 (9-15 Apr) patched a high-severity axios SSRF (GHSA-3p68-rc4w-qgx5) that pnpm audit caught in a routine MR pipeline. The pattern across the two weeks: fix boundaries in our own code, and keep dependencies patched via automated audit.

PPL: Quality Gates That Actually Block Bad Code

Thu, 09 Apr 2026 00:00:00 +0700

Quality tools are useless if they are not enforced. Our project had SonarQube analyzing every commit, schema fuzzing running against our API, and load tests measuring latency, but every single one of them was set to allow_failure: true. Violations were silently ignored, real bugs slipped through, and nobody noticed because the pipeline was always green. This blog covers how we turned those advisory checks into blocking gates, built automated CI reporting so reviewers could actually see the results, and watched the tools catch a JWT vulnerability, a production crash, and 31 code quality violations that had been accumulating for weeks.

PPL: Security [Sprint 2, Week 2]

Mon, 30 Mar 2026 00:00:00 +0700

What I Worked On

Two security-relevant features merged this week that directly address OWASP Top 10 vulnerabilities: blocking inactive accounts from authenticating (SIRA-215) and enforcing session limits with proper invalidation (SIRA-214). SAST results are now also surfaced automatically on every MR via the CI report system.

OWASP A07: Authentication Failures

OWASP A07 covers broken authentication, including cases where deactivated or suspended accounts can still access the system. Before SIRA-215 (MR !104), deactivating a user in the admin panel only prevented login via the UI — a valid JWT issued before deactivation still passed every auth check.

PPL: Fixing a JWT Vulnerability [Sprint 2, Week 1]

Mon, 23 Mar 2026 00:00:00 +0700

What I Worked On

This week I addressed a critical security vulnerability flagged by SonarQube and hardened the CI pipeline so security issues block merges instead of being silently reported.

The JWT Vulnerability (SonarQube S5659)

SonarQube flagged dependencies.py:34 as a CRITICAL vulnerability: jwt.get_unverified_header() reads the JWT header without verifying the signature. This enables the alg:none attack, where an attacker crafts a token with "alg": "none" in the header, causing the library to skip signature verification entirely.

PPL: Security [Sprint 1, Week 3]

Fri, 13 Mar 2026 00:00:00 +0700

What I Worked On

This week addressed four security areas: JWT algorithm validation hardening (reviewed MR !63), encryption key management in CI (MR !68), client PII encryption in the database seeder (reviewed MR !80), and ongoing SAST scanning via the CI pipeline.

JWT Algorithm Validation: Preventing alg:none Attacks

MR !63 (by adipppp, which I reviewed) hardened the JWT decoding logic against the alg:none attack, one of the most well-known JWT vulnerabilities (OWASP A07:2021, Identification and Authentication Failures).

Security on Daffa Abhipraya

PPL: Security, From App Code to Supply Chain [Sprint 2, Week 3]

# What I Worked On

PPL: Quality Gates That Actually Block Bad Code

PPL: Security [Sprint 2, Week 2]

# What I Worked On

# OWASP A07: Authentication Failures

PPL: Fixing a JWT Vulnerability [Sprint 2, Week 1]

# What I Worked On

# The JWT Vulnerability (SonarQube S5659)

PPL: Security [Sprint 1, Week 3]

# What I Worked On

# JWT Algorithm Validation: Preventing alg:none Attacks

What I Worked On

What I Worked On

OWASP A07: Authentication Failures

What I Worked On

The JWT Vulnerability (SonarQube S5659)

What I Worked On

JWT Algorithm Validation: Preventing alg:none Attacks