I'm sure last week's PHP and Node.js security exploits also made headlines on your timeline. And this wasn't the only event recently. Weeks before, several popular extensions caused security issues in Shopify's checkout, another incident in what seems to be a trend: exploits affecting en mass websites and stores. It's the paradox of AI: the same technology that makes it great at building a feature in no time also makes it good at finding exploits. It can poke and prod applications and code in no time, and reason through chains of events until it finds a weak point. In many cases it's an exploit introduced into some small library used by hundreds of SaaS solutions and application you are using daily.
A part of my job as the founder of Open Commerce is security. It is something we take incredibly seriously, as we've seen what happens when it fails. Ransomware, stolen data, and DDoS attacks are more common than ever.
I wanted to share how we address security, and why this is a decent chunk of my day-to-day job.
Let's start at the beginning. It's not the tech but the humans that are often a vulnerability. Answering a phishing mail, clicking a malicious link, or using public wifi. Everyone on our team is enrolled in a training program for cyber security. Occasionally we send out phishing emails to make sure the team paid attention in the courses. Then on the tech. Our laptops, phones, really any device we work on is required to have a virus scanner. Besides that, we've put in place solutions to actively monitor devices for missing updates, unencrypted tokens and passwords, and other potential bad practices. Regarding passwords, those are all stored in company-managed key vaults used by everyone. We have a strict policy on using company-issued software, even for freelancers. including Claude and ChatGPT. We actively monitor those for the use of tools and MCP connections through AI, as well as potential prompt injections.
Since our work is online, we use a VPN, in particular one that allows us to connect to servers. Without that, a connection is not possible. We have the same antivirus and active device monitoring on servers where we can. We partner with reliable infrastructure providers such as Hypernode, OVH Cloud, and GCP, and we ensure up-to-date software and frequent backups.
One of our recent initiatives I'm particularly excited about is an automated triage process powered by AI. For constant security scanning, we rely on Aikido.dev. They scan each project for outdated dependencies, malicious code, exposed secrets, etc., whenever something is found, the agentic triage flow pulls the project from its version control repository, analyzes the Aikido report, applies a fix, runs all tests, fixes bugs, and then pushes out production-ready code to a developer for a quick review. This reduces time to react to issues drastically.
Similar for bugs, which we monitor through a central application. Any severe report is automatically analyzed and solved, or escalated to an engineer for further review.
Keeping applications up-to-date is table stakes these days. Whether it's SaaS, self-hosted, or custom web applications. The same goes for your front-end. We've started rolling out Cloudflare as a firewall for our clients, something that was vital when one of our clients was recently under a sustained DDoS attack.
Our job as an agency is constantly being redefined in response to the world around us. Writing code was always the easy part. Knowing when to use what tools and platforms, doing so securely, and offering around-the-clock service is the real challenge.
If you're interested in how we roll out security training for our team, the device monitoring, or any of the other topics above, I always enjoy talking about it and am happy to share what I know. Send me a message to nerd out on it!
Sander Mangel
Senior Solutions Architect
4 min read
