इस एपिसोड के बारे में
A file-upload vulnerability in Rails Active Storage just scored a 9.5 out of 10 on the severity scale, high enough that, as Justin Edwards puts it: "Everybody stop what you're working on and get this patched." In this episode of SaaS That App, Aaron Marchbanks and Justin break down what made this one so dangerous (anonymous, unprivileged file uploads were enough to compromise a server), why it took two separate patches to actually close the hole, and how they decided which client projects needed a full credential rotation and which didn't.
What You'll Learn:
- Why this CVE was "as bad as it gets;" vulnerable by default, exploitable by anyone with file upload access, and one step away from full remote code execution
- The real difference between patching a vulnerability and actually remediating it (hint: rolling every API key and secret your app touches)
- How Justin used two real client situations, a three-person beta test vs. a consumer app with thousands of users, to decide when "assume breach" is overkill and when it's non-negotiable
- The concentric circles (and Swiss cheese) framework for layering security so no single failure becomes catastrophic
- Why AI hasn't triggered the predicted vulnerability apocalypse, and might actually be helping more than hurting
- The homeownership metaphor for why "done building" doesn't mean "done maintaining"
This podcast is brought to you by Delta Systems, your one-stop shop for front-end, back-end, and full-stack software development. At Delta, Justin and Aaron share the same philosophy when it comes to clients: they treat people like colleagues, not just customers. Maybe that’s why Delta typically spends years working with the same companies: how many software engineering firms can you say that about? So, if you’ve got a big SaaS project in mind but have no idea where to start, come and get a free scope and estimate from Delta Systems at: https://deltasystems.com/
Got a burning idea for an episode, or a SaaS question you absolutely must know the answer to? Leave us a voice memo: https://www.speakpipe.com/SaasThatApp
Highlights:
- [01:28] What Is a CVE, Anyway?
- [03:19] The Rails Active Storage Vulnerability Explained
- [06:35] The Race Between Disclosure and Exploitation
- [09:43] When to Roll and When to Accept Risk
- [11:31] Why Environment Isolation Saves You in a Crisis
- [13:52] Is AI Going to Cause a Vulnerability Explosion?
- [14:35] Concentric Circles and Swiss Cheese
- [17:26] Why Every SaaS Founder Needs to Budget as Homeowners
- [19:29] The One Thing Every Team Should Automate
Episode Resources:
- Aaron Marchbanks on LinkedIn
- Justin Edwards on LinkedIn
- CVE Record
- Rails Security Advisory
- Delta Systems Website
Saas That App is handcrafted by our friends over at: fame.so
Check out our three most downloaded episodes:
- AI-Assisted Development: Expectations vs. Reality with Richardson Dackam
- How to Price SaaS for Maximum Growth with Dan Balcauski
- You're Shipping Constantly - So Why Aren't You Growing? With Daniel Layfield
We’d love your feedback. Please take a moment to fill out our audience questionnaire:
https://forms.gle/DN8hWFDcE9jwvNKo6
Your input helps us shape future episodes and continue bringing you practical, real-world insights into building B2B web applications.
अंग्रेज़ी
संयुक्त राज्य अमरीका
अनुलिपि 🔗
Are you the producer of this podcast?
Add a podcast transcript
Need Audio-to-Text?
Transcribe with Listen411 in Just 60 Seconds
पिछले एपिसोड्स खोजें
SaaS That App - Building Tech-Enabled Businesses के पिछले एपिसोड खोजें।
इस पॉडकास्ट के अन्य एपिसोड
Teams don't know their customer, and that gap, not a lack of features, is what quietly stalls SaaS growth. In this episode of SaaS That App, hosts Aaron Marchbanks and Justin Edwards sit down with Gia Laudi, a customer-led growth expert who's advised Postman, Bitly, Sprout Social, EverCommerce, and…
340,000 users. No paid ads. And a direct competitor in ChatGPT. That combination shouldn't exist, but Ajelix made it a reality. In this episode of SaaS That App, hosts Aaron Marchbanks and Justin Edwards talk with Agnese Jaunošāne, Co-founder and COO of Ajelix, about how she and her co-founder buil…
When a trusted vendor triples your bill overnight? Staying is no longer an option.
In this episode of SaaS That App, hosts Aaron Marchbanks and Justin Edwards share what happened when Harvest, their tool of choice for nearly ten years, got acquired by Bending Spoons and hit them with confusing usag…
Most companies don't have a sales problem. They have a playbook problem. And it's costing them every deal that should've closed.
In this episode of SaaS That App: Building Tech-Enabled Businesses, Tom Stearns and Peter Cleary, co-authors of Graphic Sales, join Aaron Marchbanks and Justin Edwards to…
Delta Systems co-owner Steve Powell built a production-grade SaaS app in under 200 hours…. without actually knowing the stack.
Not a prototype. Not a demo. A real, deployed application: myeaglecoach.com, used by Scout leaders to manage documents, e-signatures, collaboration, and project workflows, …
अस्वीकरण: इस पृष्ठ पर एम्बेडेड पॉडकास्ट और कलाकृति Delta Systems से हैं, जो इसके मालिक की संपत्ति है और Listen Notes, Inc. से संबद्ध या समर्थित नहीं है।
संपादित करें
पॉडकास्ट डेटाबेस को अपडेटेड रखने में मदद के लिए धन्यवाद।
