Tag Info

Hot answers tagged

1

The DB URL (other than username and password) and Pepper aren't sensitive values. You may not want to advertise them, but you should assume they are known anyway. If your security is dependent on them being secure, then you are almost certainly not PCI compliant. Any "security" that that secrecy provides is just security by obscurity. The DB should be ...


1

Look up the OWASP Top 10 (which is the most relevant resource for your question) proposed by edvinas.me and the list of Web-oriented attacks covered by fel1x. I don't have good advice for Web server security because I haven't done it in ages, but make sure you keep your servers up to date and that they run with only the privileges they need (separate OS ...


1

Encrypt the database with a key and only store the key in memory Add common security headers. You can look at what other sites use (for example kraken.com) and use the same HTTP headers after reading up on them (short list: HSTS, nosniff, XSS protection, XFO, CSP) Test for XSS Make sure the RoR XSRF protection works Try to find a pentest company to do a ...



Only top voted, non community-wiki answers of a minimum length are eligible