Matheus Cardoso 🇺🇦

@cardo.so

https://github.com/cardoso https://linkedin.com/in/cardosodev

All the many other problems aside, CoderByte doesn't do any sanitization of logs before it hits their "in-browser" console. Not even HTML. Yes, it will display anything, buttons, iframes, you name it, and sometimes it will crash and burn. It's funny, but sad that it's used to evaluate candidates.

I believe @pnpm.io is leading the pack in terms of out-of-the-box dependency management in monorepositories and more recently supply chain risk management. Are people getting the same benefits from modern yarn or npm? How do you set those up?

If your automated security tools flags this esbuild CVE in your Vite app, go report it to them. Vite doesn't use the esbuild dev server. Always provide a minimal repro for security issues. Kudos again to @sapphi.red for fixing the original CVE on Vite and reporting it to other affected tools.

Any websites were able to send any requests to the development server and read the response

### Summary esbuild allows any websites to send any request to the development server and read the response due to default CORS settings. ### Details esbuild sets `Access-Control-Allow-Ori...

github.com