SecurityGuide
Fuzzing for Security Bugs in Rust Parsers Step by Step
Fuzz a Rust parser for security bugs: panics, hangs, huge allocations and unsafe memory errors. Set up targets with limits, run with sanitizers and triage crashes.
16 min read
Topic
Security
Auditing dependencies, handling hostile input and closing the gaps attackers actually use.
SecurityGuide
OAuth 2 Clients in Rust With the oauth2 Crate Step by Step
Implement the OAuth 2 authorization code flow with PKCE in Rust using the oauth2 crate: build the client, redirect, verify state, exchange the code and store tokens safely.
14 min read
SecurityGuide
Reproducible Builds in Rust and Verifying a Binary
A reproducible build produces the same bytes from the same source anywhere. See what breaks it in Rust (paths, timestamps, toolchains), how to fix each, and how to verify a binary.
14 min read
Security
Denial of Service Through Rust Parsers and Resource Limits
A parser that accepts any input can be made to use unbounded memory, time or stack. Set limits on size, depth and time, and know which crates already have them.
3 min read
Security
Path Traversal in Rust File Servers and Safe Joins
A user-supplied filename like ../../etc/passwd escapes your upload directory. Reject components, canonicalize and verify the prefix, and see why Path::join with an absolute path is a trap.
3 min read
Security
SQL Injection in Rust and Why Typed Queries Help Explained
Rust's type system does not stop SQL injection, but parameterized queries do. See the vulnerable pattern, how bind parameters fix it, what cannot be bound and how to handle dynamic identifiers safely.
3 min read
TestingGuide
Fuzzing Rust Code With Cargo Fuzz and Libfuzzer Step by Step
Fuzz a Rust function with cargo-fuzz and libFuzzer: init, write a target, run, read crashes, minimize inputs, add a corpus and turn findings into regression tests.
14 min read
Security
JWT Validation in Rust Without the Usual Mistakes Explained
The mistakes that make JWT checks worthless: accepting the none algorithm, trusting the header's alg, skipping exp and aud, and mixing key types. Validate correctly with the jsonwebtoken crate.
3 min read
Security
Handling Secrets in Rust With Zeroize and Secrecy Explained
Wrap secrets so they never print, and wipe them from memory on drop. Use the secrecy and zeroize crates, understand what zeroing can and cannot guarantee and avoid accidental copies.
3 min read
Databases
SQLx Dynamic Queries With QueryBuilder Without SQL Injection
Build WHERE clauses from optional filters with QueryBuilder and push_bind, so values stay parameters and the SQL stays safe. Includes lists with IN and sorting by allowed columns.
3 min read
Security
Constant Time Comparisons in Rust and Why Equality Is Unsafe
Comparing secrets with == returns at the first difference, which leaks how many bytes matched. Use subtle ConstantTimeEq for tokens and MACs and understand what constant time can and cannot promise.
3 min read
DevOps
Secrets Management for Rust Services in Production
Keep credentials out of images, repositories and logs. Compare environment variables, mounted files, systemd credentials and a secret manager, and plan for rotation.
3 min read
Get new posts by email
We send one email when a new post is published. No spam.