Security

Security is very important to us here at Sixt. Articles in this category tell all about our experiences, learnings, and developments in the realm of security. This includes individual findings, team experiences, and also projects headed by our Security Guild.

• Public Service Announcement on Slack Webhook Security

  Nov 12, 2021 • Scott Finlay • Security

  While experimenting with different tools for detecting hard-coded credentials, we noticed that some (like GitHub Advanced Security) point out Slack webhooks if they appear in code. At first, we mostly ignored those since they seemed like fairly low risk if any at all. Then, just for fun, we added the pattern to our own home-grown scanner

  read more

• The Bot Saga

  Nov 10, 2021 • Scott Finlay • Security

  There comes a time in the lifespan of all large websites when bot traffic becomes an issue on some scale or another. Sometimes you get bombarded with scrapers and your servers can’t handle the load. Sometimes malicous users attempt to brute force security-related endpoints. Sometimes bots drop spam content into input fields. Regardless of the usecase, eventually the problem grows enough that it needs to be addressed somehow.

  This happened to us, and here’s the long road we traveled.

  read more