Application Security Insights
Practical guides, real-world attack scenarios, and expert tutorials for founders, CTOs, and developers building secure Node.js applications.
How to Investigate an Account Takeover by Asking Questions
A step-by-step account takeover investigation in plain English: the ten questions to ask, where each answer lives in your logs, traces and security events, and what to check before you call it closed.
Let Your Coding Agent Block Attackers and Add Rate Limits Over MCP
Copy-paste prompts and a safe two-step workflow: your coding agent investigates an attack with read-only SecureNow MCP tools, proposes scoped rules, and applies them on your yes.
Block an IP, a Range or One Route Without a Deploy (Node.js)
Block one IP, a CIDR range, or a single route and method in a Node.js app within seconds, with no code change: setup, scoping, CLI, MCP, verification and undo.
Why Per-IP Rate Limits Fail Against Rotating IPs (and What to Count Instead)
One login, 100 rotating IPs: a 10-per-minute-per-IP limit let 275 of 275 requests through. How to spot rotation in your traffic and what to key your limits on.
Rate Limit per API Key, per Session or per IP in Node.js, Without Code Changes
Add rate limits by route and method, counted per IP, per API key, per session cookie or globally, written in plain English and shared across servers with Redis.
How to Tell If Your Web App Is Under Attack (and What to Do)
Failed-login spikes, 404 bursts, one IP trying many usernames: how to tell if your web app is under attack, confirm it in your logs, and act in hour one.
11 Signs Your AI-Built App Needs a Security Audit
Built your app with a coding agent? 11 warning signs it needs a security audit, each checkable in five minutes, and how to run the full audit yourself.
Why Is My App Getting /.env and wp-login.php Requests?
Those /.env, /.git and wp-login.php hits are bots hunting leaked secrets. See which matter, check you expose nothing, and what to do if one returns 200.
AI Security Audit Part 1: Set Up Your Agent to Audit Code
Part 1 of the AI security audit series: set up an AI coding agent to audit your app locally, connect SecureNow, and run your first threat-model pass.
AI Security Audit: How to Audit Your App's Code With AI
Audit your app's security with the AI coding agent you already use. Find code vulnerabilities, turn them into runtime detections, and never upload code.
AI Security Audit Part 2: Authentication & Sessions
Part 2 of the AI security audit series: audit login, sessions, MFA, password reset and magic links for account-takeover paths, then catch live attempts.
AI Security Audit Part 3: OWASP API Top 10
Part 3 of the AI security audit series: audit your REST or GraphQL API against every OWASP API Security Top 10 (2023) risk, from BOLA to API inventory.
AI Security Audit Part 4: Injection, XSS & SSRF
Part 4 of the AI security audit series: use an AI agent to find SQL and command injection, SSTI, XSS, CSRF and SSRF, the bugs that turn data into code.
AI Security Audit Part 5: Findings to Runtime Detections
Part 5 of the AI security audit series: turn your AI audit's detection report into always-on runtime rules, detection as code, blocking and rate limits.
AI Threat Modeling: How to Do It With Claude Code or Cursor
Threat modeling used to mean hand-drawn diagrams. Learn to threat-model your real codebase with an AI coding agent, and where it beats the old tools.
How to Secure a Vibe-Coded App: AI-Generated Code Checklist
Security checklist for vibe-coded and AI-generated apps: access checks, leaked keys, Supabase rules, injection, webhooks and rate limits, with quick tests.
OWASP API Security Top 10 (2023): A Developer's Guide
Each OWASP API Security Top 10 (2023) risk explained for developers: what it means, how to spot it in your code, and a free AI prompt to audit your API.
AI Code Security Audit: Free Prompts, No Code Upload
Run an AI code security audit with Claude Code, Cursor or Codex: free threat-modeling prompts that find vulnerabilities without uploading your repository.
Create Custom Alert Rules From the Command Line
SecureNow 8.1 adds securenow alerts rules create: write detection rules in SQL, scope them to your apps and ship them from the terminal, with an example.
A Next.js AWS App That Investigates and Blocks an Attack
We deployed a Next.js app to AWS with SecureNow traces, logs, body capture and firewall, then used an AI-assisted MCP workflow to block the attacker's IP.
Secure Next.js With SecureNow Using an AI Onboarding Prompt
A copy-paste prompt for an AI coding agent that installs SecureNow in Next.js, verifies traces and logs, deploys to AWS, and proves firewall blocking.
10 Web Development Security Best Practices for Node.js
A prioritized checklist of web development security best practices for Node.js teams, from secure coding to production monitoring and incident response.
10 Best Application Security Monitoring Tools in 2026
An honest, side-by-side comparison of the ten most-deployed application security monitoring tools — from enterprise platforms to free open-source options.
The 2026 npm Supply-Chain Attack Survey, Q2
Quarterly tally of malicious npm packages: April 2026 set a record with 847 confirmed, plus major incidents and the runtime detection patterns that work.
The $3,400 Egress Bill: A 72-Hour Scraping Post-Mortem
How a scraping campaign ran up $3,400 in egress over 72 hours, what our detection missed, what we changed, and what would have stopped it much earlier.
Datadog Alternatives: 7 Options Compared by Real Engineers
Seven Datadog alternatives compared head to head: Grafana Cloud, HyperDX, Dash0, Uptrace, New Relic and SecureNow, with what each is good and bad at.
7 Free Firewall Options for Node.js Apps in 2026
Free firewall and WAF options for Node.js compared: Cloudflare free tier, AWS WAF, ModSecurity, Fail2ban and middleware, with setup effort and tradeoffs.
Adding Backend Tracing to a Sentry Stack with OpenTelemetry
Using Sentry for frontend errors? Add backend distributed tracing with OpenTelemetry, keep trace context linked, and avoid doubling your Sentry bill.
Why Your APM Is Missing the Credential-Stuffing Attack
APM dashboards plot p99 latency, not attacker behavior. The same span data hides credential stuffing in plain sight. Here's how to surface it.
Application Security Monitoring Tools — 2026 Buyer's Guide
Eight application security monitoring tools compared on detection breadth, integration cost, pricing and team fit, with the tradeoffs vendors leave out.
Application Security Monitoring vs RASP: When Each One Wins
ASM observes and RASP blocks, and the difference matters more than vendors admit. When each is the right call, and the hybrid most mature teams use.
How to Block Bot Traffic in Express With No Extra Infra
Five ways to block bot traffic in Express, ranked by effort and effectiveness, from a 5-line blocklist to IP reputation, without Cloudflare or AWS WAF.
How to Block Bot Traffic in Fastify With No Extra Infra
Fastify hooks (onRequest) and the SecureNow preload both work cleanly. Here's the production setup for IP blocking and user-agent filtering.
How to Block Bot Traffic in NestJS With No Extra Infra
NestJS guards, interceptors, and global middleware all give you bot-blocking hooks. Here's the cleanest pattern for each.
How to Block Bot Traffic in Next.js With No Extra Infra
Three patterns for bot blocking in Next.js — middleware, instrumentation, or preload — ranked by what works on Vercel, self-host, and the App Router.
How to Block Bot Traffic in Nuxt With No Extra Infra
Nuxt server middleware + Nitro hooks give you bot-blocking primitives. Here's the production setup for self-hosted Nuxt 3.
Capture Request Bodies in Express Without Leaking Secrets
Request bodies speed up incident investigation but leak passwords, tokens and PII if captured naively. Here is the redaction-first pattern for Express.
Capture Request Bodies in Fastify Without Leaking Secrets
Capture Fastify request bodies for forensics with a preHandler hook that redacts passwords and tokens first, plus handling multipart and responses.
Capture Request Bodies in NestJS Without Leaking Secrets
A redaction-aware NestJS interceptor that captures request bodies for forensics across REST, GraphQL and microservices without storing passwords or tokens.
Capture Request Bodies in Next.js Without Leaking Secrets
Redaction-aware request body capture for Next.js Route Handlers and Server Actions in the App Router, so traces show what was sent without leaking secrets.
Capture Request Bodies in Nuxt Without Leaking Secrets
Capture Nuxt request bodies for forensics with server middleware and h3 utilities, redacting secrets first. Works on Nuxt 3 and self-hosted Nitro.
Continuous Application Security Monitoring on a $0 Budget
You don't need a $50k/year ASM contract to get continuous security monitoring. Here's the open-source, OpenTelemetry-based stack you can run for free.
Tracking Customer Cost-of-Serve from Your Trace Data
Work out what each customer costs to serve from OpenTelemetry traces, then use per-customer cost to price enterprise tiers and judge discount requests.
Datadog Alternatives Ranked by Real Bills (Not Marketing)
What you'd actually pay on the eight most-deployed Datadog alternatives, calculated for a representative 30-host SaaS scanning 200 GB/month.
Datadog ASM vs a WAF: Which One Actually Blocks Attacks?
Datadog Application Security Monitoring detects attacks but does not block them by default. Where that gap matters, and what to pair it with.
Detecting Credential Stuffing in Express in 30 Lines
A working credential-stuffing detector for Express in 30 lines of middleware: count auth failures per IP in a sliding window and block offenders.
Detecting Credential Stuffing in Fastify in 30 Lines
An onRequest hook + a preHandler hook that catches per-IP credential stuffing in Fastify. Production-ready in under 30 lines.
Detecting Credential Stuffing in NestJS in 30 Lines
A working credential-stuffing guard for NestJS using a Guard + ThrottlerModule. Production-ready in 30 lines plus the module config.
Detecting Credential Stuffing in Next.js in 30 Lines
A working credential-stuffing detector for Next.js: middleware blocks offenders and an API route records failures in KV. Runs on Vercel Edge or Node.
Detecting Credential Stuffing in Nuxt in 30 Lines
A Nuxt server middleware + a server route handler that catches per-IP credential stuffing. Works on self-hosted Nuxt 3 and adapts cleanly to Vercel.
Detect Business-Logic Abuse With the Spans You Already Have
Cart cycling, refund fraud, free-tier abuse, coupon stacking — none of these match a WAF rule, but all show up in trace data if you know what to query.
Adding an IP Firewall to Express Without Cloudflare
You don't need a CDN to block bad IPs in Express. Add a managed IP blocklist in one line, or use a manual middleware fallback with zero dependencies.
Adding an IP Firewall to Fastify Without Cloudflare
Add an IP firewall to Fastify without Cloudflare, a CDN or DNS changes: a one-line SecureNow preload with a managed blocklist, or your own onRequest hook.
Adding an IP Firewall to NestJS Without Cloudflare
NestJS sits on top of Express or Fastify. Either way, the SecureNow preload adds an IP-reputation firewall in one line — no DNS changes.
Adding an IP Firewall to Next.js Without Cloudflare
On Vercel, Edge middleware blocks at the edge. On self-host, the SecureNow preload blocks at the HTTP server. Both work without DNS changes.
Adding an IP Firewall to Nuxt Without Cloudflare
On self-hosted Nuxt the SecureNow preload works. On Vercel-deployed Nuxt, server middleware + Vercel KV gives you the same outcome.
Migrate From Datadog APM to OpenTelemetry in One Afternoon
A pragmatic four-hour migration playbook from Datadog APM to OpenTelemetry-native observability — including the gotchas nobody warns you about.
OpenTelemetry-Native APM Tools That Aren't Datadog
Five APM tools that use OpenTelemetry as the primary path, not as a bolt-on. Compared on what 'native' actually means in practice.
OpenTelemetry vs APM Agents: Overhead and Lock-in Compared
OpenTelemetry or a vendor APM agent (Datadog, New Relic, Sentry)? Latency, memory, cold-start and CPU overhead on one Express workload, and when to switch.
The Per-Host Pricing Trap (And How to Escape It)
Per-host APM pricing made sense in 2014 but fits SaaS badly in 2026. The math, why vendors keep it, what usage-based pricing looks like, and how to escape.
Per-Tenant SLOs in a Multi-Tenant SaaS with OpenTelemetry
Aggregate SLOs hide the customer who's about to churn. Here's how to track per-tenant error rates and latency using standard OpenTelemetry conventions.
Express Rate Limiting: Production Setup, Redis & Proxies
Configure express-rate-limit for production: trust the right proxy, share counters with Redis, set per-route limits, and verify 429s against real traffic.
Rate Limiting in Fastify That Actually Works
@fastify/rate-limit + Redis is the production-grade combo. Here's the config that handles trust proxy, per-route limits, and per-user keys correctly.
NestJS Rate Limiting: Throttler, Redis Storage and Proxies
NestJS rate limiting in production: ThrottlerModule config, shared Redis storage across instances, per-route limits, and the real client IP behind proxies.
Next.js Rate Limiting: proxy.ts, Redis and Real Client IPs
Rate limit Next.js API routes and logins in production: proxy.ts (Next 16) or middleware.ts, a shared Redis store, the real client IP, and per-user keys.
Rate Limiting in Nuxt That Actually Works
Nuxt 3 doesn't ship a rate-limit module, but Nitro's event handlers + Upstash Redis give you production-grade rate limiting in 30 lines.
Sentry Per-Event Pricing: Why Your Error Bill Spikes
Sentry bills per captured event. What triggers cost spikes (noisy frontend errors, retries, bots), the pricing math, and how to keep the bill predictable.
Sentry vs Datadog vs SecureNow: Full-Stack Compared (2026)
Sentry, Datadog and SecureNow compared on pricing, feature breadth and lock-in: a frontend-led tool, a per-host platform, and combined APM plus security.
Web Application Security Monitoring with OpenTelemetry
How to use OpenTelemetry traces as the foundation for application security monitoring — the same data your APM uses, repurposed for attack detection.
The Real Datadog Bill: A $40k/year SaaS Migration Story
What a 30-host SaaS team paid Datadog, the line items that grew the bill, how to cut it without leaving, and what the same workload costs after migrating.
Datadog vs OpenTelemetry: When to Drop the Agent
Datadog now accepts OTLP, so its agent and the OpenTelemetry SDK overlap on 90% of tracing. When the agent still makes sense, and when it is just lock-in.
Multipart File Upload Security Monitoring With Tracing
Multipart uploads are a blind spot in most tracing setups. See the security risks they carry and how to capture upload metadata without buffering files.
Nuxt 3 Security Monitoring With SecureNow: Setup Guide
Add SecureNow security monitoring to a Nuxt 3 app with the official Nuxt module: install, nuxt.config.ts, env vars, deployment, CLI checks and fixes.
Trace ESM and CommonJS Node.js Apps With One -r Flag
securenow/register now auto-registers the ESM loader hook via module.register() on Node 20.6 and later, so one -r flag traces both CommonJS and ESM apps.
Axios npm Compromise 2026: Check Your Project and Runtime
Check your Node.js project for the Axios supply chain attack that shipped a remote access trojan via plain-crypto-js, with an AI audit prompt and IOCs.
Next.js on AWS EC2: Security Monitoring With SecureNow
Add SecureNow to a self-hosted Next.js app on AWS EC2: instrumentation, env config, verifying traces and logs, request body capture and alert rules.
Fastify Security Monitoring With SecureNow: Setup Guide
Add SecureNow security monitoring to a Fastify API: CLI setup, instrumentation, body capture caveats, PM2 and Docker deployment, and verification.
Feathers.js Security Monitoring With SecureNow: Setup Guide
Add SecureNow security monitoring to a Feathers.js app: trace the Express transport and every service endpoint, then deploy with PM2 or Docker.
h3 and Nitro Security Monitoring With SecureNow
Add SecureNow security monitoring to an h3 or Nitro app: CLI setup, instrumentation, body capture, PM2 and Docker deployment, and notes for Nuxt 3.
Hapi.js Security Monitoring With SecureNow: Setup Guide
Add SecureNow security monitoring and tracing to a Hapi.js app with one npm package: CLI setup, instrumentation, PM2 and Docker, and verification.
Hono Security Monitoring With SecureNow: ESM Setup Guide
Add SecureNow security monitoring to a Hono app: the ESM preload flag, why body capture must stay off, CLI setup, and PM2 or Docker production deployment.
Koa Application Monitoring and Security With SecureNow
Add security monitoring to a Koa.js API with the securenow npm package: CLI login, app setup, body capture, PM2 and Docker deployment, and verification.
Raw Node.js HTTP Server Security Monitoring With SecureNow
Add security monitoring to a raw Node.js http.createServer app with SecureNow. No framework or middleware: one npm package, CLI setup, PM2 and Docker.
NestJS Security Monitoring With SecureNow: TypeScript Setup
Add SecureNow security monitoring to a NestJS app: instrument.js setup, TypeScript compatibility, package scripts, PM2 and Docker, and verification.
Polka Security Monitoring With SecureNow: Setup Guide
Add SecureNow security monitoring to a Polka app: body parsing, CLI setup, instrumentation, PM2 and Docker deployment, and what it detects automatically.
Express.js Security Monitoring With SecureNow: Setup Guide
Add SecureNow security monitoring to an Express.js app: CLI login, app setup, instrumentation, logging, PM2 and Docker deployment, and verifying traces.
Next.js Security Monitoring With SecureNow: Setup Guide
Add SecureNow security monitoring to a Next.js app through the instrumentation hook: CLI login, env vars, Vercel deployment, body capture and verification.
How to Automate IP Threat Investigation with AI in Your SOC
Use AI to investigate suspicious IPs automatically: threat verdicts, risk scores and recommended responses, so analysts spend less time on manual triage.
SOC Alert Triage: From Overload to Actionable Incidents
A structured SOC triage workflow for security alerts: filter, prioritize by severity, track status, and use AI investigation to resolve real incidents.
How to Reduce False Positives in Security Alerts
Cut false-positive security alerts without missing real attacks: why rules misfire, scoped exclusions, test-before-apply, and measuring alert quality.
Real-Time IP Monitoring: Track Thousands of Suspicious IPs
Monitor suspicious IPs in real time with automatic IPDB enrichment, geo and ASN data, status tracking and batch lookups, so your team can act on them fast.
Security Alert Rules That Catch Threats Without the Noise
Design SQL-based security alert rules with throttling, channel routing and per-rule exclusions, so real threats reach the right people without the noise.
Credential Stuffing Detection: A 12-Minute SOC Case Study
How a SOC team used alert rules, AI investigation, IPDB corroboration and forensic queries to detect and contain a credential stuffing attack from 47 IPs.
AI Trace Analysis: Find Attacks Hidden in Application Spans
How AI analysis of trace spans uncovers SQL injection, SSRF, auth bypass and path traversal that WAFs miss, by examining application behavior span by span.
Security Forensics in Plain English: Query Your Traces
Ask security questions in plain English and get SQL results from your ClickHouse trace data, plus a saved query library and direct SQL for power users.
How to Find Undocumented APIs Before Attackers Do
Find undocumented, shadow and zombie API endpoints from live traffic, then map their parameters, auth and exposure before attackers enumerate them.
IP Intelligence Enrichment: Beyond Basic IP Reputation
Combine IP reputation from SecureNow AI IPDB with application trace behavior for higher-confidence verdicts, automatic enrichment and faster response.
Quadrant Analysis: Spot Malicious IPs by Traffic Behavior
Plot each IP's successful versus error responses to spot scanners, bots and credential stuffers at a glance, and see what each quadrant says about intent.
API Abuse Detection and Remediation: A 45-Minute Case Study
Detecting and stopping an API abuse campaign on a shadow API, step by step, using API surface discovery, AI investigation, trace analysis and forensics.
Security Observability With OpenTelemetry in 15 Minutes
A step-by-step guide to instrumenting your app with OpenTelemetry and sending traces to SecureNow for real-time threat detection, AI analysis and alerts.
From Traces to Security Alerts: A Developer's Guide
Set up security alerts without a dedicated SOC: detect 4xx spikes, error patterns and suspicious IPs with trace-based alert rules and throttling.
ClickHouse Queries for Security Analytics on Trace Data
Write ClickHouse SQL for security analytics on OpenTelemetry traces: find suspicious IPs, spot error patterns, and turn useful queries into alert rules.
How a Developer Caught a Supply Chain Attack in Trace Data
A realistic scenario: a compromised npm package shows up as unexpected outbound HTTP calls in OpenTelemetry traces, and AI analysis helps contain it.
SecureNow Workflow: From First Trace to Incident Resolution
A walkthrough of the full SecureNow workflow: app setup, trace monitoring, alert rules, triage, AI investigation, forensics and false positive handling.
How to Stop a Distributed Bot Attack: A Response Playbook
A step-by-step playbook for detecting and stopping a distributed bot attack with quadrant analysis, AI investigation, IPDB enrichment and forensic queries.
Detect Insider Threats With Application Trace Anomalies
Detect insider threats from application trace patterns such as after-hours access, unusual data exports and privilege escalation, with forensic queries.
Trace-Based Security vs SIEM for Modern Applications
Trace-based application security monitoring vs a traditional SIEM, compared on detection fidelity, false positive rates, time to detection and total cost.
How to Integrate SecureNow with Your Next.js Application
Complete guide to adding enterprise-grade security monitoring to your Next.js app with SecureNow. Learn automatic setup, manual configuration, and best practices for production deployment.
Node.js App Monitoring with PM2: Setup, Commands and Security
Monitor a Node.js app in production with PM2: ecosystem config, pm2 monit and log commands, troubleshooting, and attack detection and traces via SecureNow.