Security on code.kiwi.com

The Old Way Is Dead: A Security Team's Manifesto for GRC Engineering

Tue, 23 Sep 2025 13:47:39 +0000

For a long time, security teams were often perceived as the "department of no" viewed as a barrier to agility and a blocker to new initiatives. This reactive posture, born from a focus on "firefighting" and a legacy of manual processes, led to security being an afterthought, added on at the end of a project. However, the mandate of a modern security team is to be a business enabler. Instead of simply mitigating risk, a security team helps the organization take informed, "smart risks" that enable growth whilst maintaining an acceptable level of security. By implementing a robust security framework, a modern security team enables the business to innovate and move with speed and confidence.

Phishers Thrive in Free Tiers - A Case Study

Fri, 20 Sep 2024 11:35:54 +0000

Analysis (a.k.a. The Facts)

Step 1: Email

The email is simple and vaguely technical. A splash of color and a clear message:

Attention: victim@provider.tld

Authentication for victim@provider.tld is set to expire today 9/17/2024 7:18:10 a.m.

Access to the mailbox and documents will be limited after expiry, Maintain / Renew login key to continue using the mailbox.

Password Policy Attacking Costs, part 2: Practical Problems

Tue, 23 Jul 2024 12:46:47 +0000

As mentioned in part 1, the source code is on Github

Scraping

Whenever you work with data sourced from web pages, you should be thinking about scraping. Why you should do that? If the data source is updated, you just click enter and your experiment runs with fresh data.

Password Policy Attacking Costs, part 1: Theory and Results

Tue, 23 Jul 2024 12:42:56 +0000

Password policy is a similarly famous concept. To ensure your password is strong, follow these simple rules (or not so simple - check out this funny game).

But what exactly does this mean for an attacker? Can we measure the attacker’s effort in dollars? I have an idea.

Cautiously Configuring Copilot

Fri, 24 Mar 2023 11:13:51 +0000

Conclusion (or TL: DR;)

To keep things short for a busy professional who'll take my words at face value - I think this can be done.

Look at the config options for the editor extensions - there is a setting that disables Copilot on specific files. I'd recommend disallowing all and allowing only the languages you are using.

Vault Operator for k8s

Fri, 24 Mar 2023 10:19:44 +0000

It is technology we have already used internally for 2 years, but now the time has come to share it with the community and make it open-source.
Read more to find out how it can help you, how you can contribute and what is the story behind the release!

Pentesting, Part 2: You’d Like To Buy Some?

Mon, 23 Jan 2023 20:37:00 +0000

I got a message from my friend in the lines of: “Hi! I remember you did penetration tests, we want it. Where can we order some penetration tests?”

Dear friend, I sincerely hope to answer your question in this post.

Pentesting, part 1: What is pentesting?

Mon, 10 Oct 2022 20:27:00 +0000

Do you want to know about pentesting but don’t know where to start? Not sure what the difference is between hacking and pentesting? Eager to learn how the pentesters know where to stop their activities? Want to hear all about it with a bit of a snarky attitude and in “human” language?

Hacking Node.js legacy URL API

Mon, 07 Sep 2020 19:53:00 +0000

How to bypass hostname verification to exploit allowlist functions

Introduction

Security is essential to us in Kiwi.com as it ensures our customers’ safety. We need to be proactive and search for possible security issues that might affect our business and potentially cause a loss of customers’ trust.

Towards secure by default Google Cloud: Default service accounts

Mon, 24 Aug 2020 18:51:00 +0000

Have you heard that Cloud XYZ is secure because smart engineers in XYZ have made it that way? Unfortunately, as with many other products, this isn’t exactly true when you rely on the defaults. In this article, I’ll give you one specific example from Google Cloud Platform, along with a recommendation on how you can address it.