Protect npm publishing with account 2FA and a scoped release path
Secure the maintainer account, review package publishing access and use supported trusted publishing where appropriate.
npm — Configure two-factor authentication
LA24X / Cybersecurity
Practical ways to protect your accounts and data Page 3
Recognize online traps, review account access and improve everyday security with practical defensive guidance.
Search this section ↗Topics & guides
76 topics in this section.
Check a package name before an install executes its code
Compare the exact registry name with the project’s official instructions, then inspect metadata and lifecycle scripts before installing.
owasp.org
Review a software dependency’s supply chain before trusting it
Check origin, build and distribution, update policy and the permissions a dependency gains in your environment.
OWASP — Software Component Verification Standard
Protect CI/CD credentials from the code your pipeline builds
Separate untrusted checks from privileged releases, scope workflow permissions and review third-party actions as executable dependencies.
docs.github.com
Apply least privilege without blocking legitimate work
Separate everyday access from administration, grant permissions for a defined task and review access when the task ends.
nist.gov
Cloud IAM: separate the owner, human users and application roles
Protect the recovery owner, use roles for day-to-day access and give workloads their own limited credentials.
AWS — IAM security best practices
Keep security logs that answer a question without collecting secrets
Record sign-ins, permission changes and privileged actions, protect the logs and make sure a harmless test event appears.
nist.gov
A small website may be compromised: contain access before restoring files
Preserve evidence, protect the hosting and domain accounts and recover from a verified clean version without overwriting the investigation.
NIST — Incident response recommendations
Laptop encryption protects a lost drive, not an unlocked session
Check device encryption, preserve its recovery key and distinguish powered-off data protection from account and malware security.
support.apple.com
Review Android app permissions by what each app needs to do
Inspect camera, microphone, location and contacts access, use narrower options where available and test the affected feature.
Google — Android app permissions
Prepare your phone for loss, updates and account recovery
Check the screen lock, device locator, backup and recovery methods while the phone is still in your hands.
safety.google
A GitHub Action tag can move: review the executable revision
Understand tags versus immutable commit references, verify the resolved action and keep pinned dependencies maintainable.
Google — CI/CD hardening
Build an update inventory for the devices you usually forget
Track browsers, operating systems, routers and other connected devices, with owners and support status instead of relying on one notification.
CISA — Secure Our World
Review the dependency an AI coding assistant just added
Inspect the exact new package and lockfile resolution before installation or deployment, rather than trusting a plausible generated import.
Google — CI/CD hardening
Turn a CISA advisory into an applicability and response checklist
Read scope, affected systems and mitigations, then map the advisory to your real assets instead of copying every recommendation indiscriminately.
CISA Cybersecurity Advisories
Read a CVE record against your actual product and configuration
Use the identifier to find the vendor advisory, check affected versions and conditions and distinguish severity from proven exposure.
NVD — CVE-2026-73570 record
Private Cloud Compute: understand the boundary between local and cloud AI
Read Apple’s architecture and 2026 expansion, distinguish PCC processing from separate third-party integrations and review the data path of the feature used.
Apple — Expanding Private Cloud Compute
Apple Reference Image: verify photographic origin without overclaiming truth
Understand the opt-in reference capture system, distinguish an authenticated capture from a truthful interpretation and keep privacy clues in view.
Apple — Reference Image