Blog

Mert Özen's blog posts on software development, backend, frontend, and DevOps.

Series

.NET Core Web API 36 Angular 31 JavaScript Basics 19 JavaScript Intermediate 18 JavaScript Advanced 16 TypeScript Basics 14 TypeScript Intermediate 14 TypeScript Advanced 12 Entity Framework Core 28 Dapper 16 Git & GitHub 29 Web Security (OWASP Top 10) 21 LLM Fundamentals 20 C# Fundamentals 20 Object-Oriented Programming in C# 16 C# Collections and Generics 11 LINQ 17 Asynchronous Programming in C# 17 Advanced C# 14 C# Versions 6 Solution Patterns 22 SOLID and Design Principles 12 Clean Code 13 Design Patterns 23 UML and Modeling 18 Introduction to Software Architecture 9 Clean, Onion and Hexagonal Architecture 8 Vertical Slice Architecture 6 Domain-Driven Design 12 CQRS and Event Sourcing 10 Messaging and Event-Driven Architecture 9 Modular Monolith 2 Microservices 10 UI Architecture Patterns 9 Architecture Decisions 7 System Design 15 Distributed Systems Fundamentals 11 Background Jobs and Scheduled Jobs 11 Working with Message Queues 14 Logging in .NET 10 Caching 10 Real-time Applications 9 ASP.NET Core MVC and Razor Pages 13 CI/CD Fundamentals 8 GitHub Actions 16 Jenkins 12 Web Servers and Hosting 12 Deployment Strategies 9 Kubernetes 19 ASP.NET Core Security 8

5 posts found #supply-chain

Newest Oldest Popular

Security PART 08

Hardening the npm Supply Chain: Lifecycle Scripts, Release Cooldowns, Provenance and Trusted Publishing

Hardening the npm supply chain rests on three pillars: limiting install scripts with an allow list, letting new versions wait a few days, and removing publish tokens with trusted publishing. In this post we try npm 11 and 12's allowScripts policy, pnpm's allowBuilds and minimumReleaseAge, npm's min-release-age, npm audit signatures output and OIDC-based trusted publishing with real installs against a local registry.

8 Nov 2026 10 min 1

DevOps PART 13

GitHub Actions Security: SHA Pinning, Lockfiles, pull_request_target and Preventing Script Injection

Pin actions to full commit SHAs and keep them current with Dependabot and lockfiles, pass untrusted values through env: instead of run:, and never run PR code in pull_request_target. The tj-actions case, zizmor and actionlint findings, gh actions-lock, real script injection output under act, checkout@v7 and the December 2, 2026 change, a safe workflow_run pattern and read-only cache tokens.

8 Nov 2026 12 min 5

DevOps PART 07

Pipeline Security and Secrets: Least Privilege, Short-Lived Credentials and Supply Chain

The pipeline is the most powerful user, holding production keys; keeping secrets in a store, least privilege per job, short-lived tokens via OIDC instead of long-lived cloud keys and pinning actions to commit SHAs close most of the risk. Real act output showing a base64-encoded secret escaping masking, script injection caught by actionlint, fork PR risks, and a short look at SLSA v1.2 and SBOMs.

8 Nov 2026 9 min 6

Security PART 20

OWASP Top 10: What Changed from 2021 to 2025 and Updating Old Documents

SSRF joining A01, the components problem growing into Software Supply Chain Failures, Security Misconfiguration rising to second place, the new A10 Mishandling of Exceptional Conditions and three renames. We read the 2025 methodology with its numbers and write a small .NET tool that finds old and year-less category numbers and suggests their 2025 counterparts.

6 Nov 2026 8 min 15

Security PART 06

OWASP A03: Software Supply Chain Failures — NuGetAudit, npm audit and SRI

Why is A03:2025 Software Supply Chain Failures its own category? Lessons from event-stream, Log4Shell, xz, polyfill.io and the 2025 npm incidents; NuGetAudit scanning transitive dependencies on net10.0, warnings that break the build, lock files, npm audit and npm ci, SRI for CDN scripts, an SBOM with CycloneDX, provenance and Dependabot.

6 Nov 2026 11 min 13