Black Hat USA 2026: What to Expect in Las Vegas
Our full preview of the Mandalay Bay week: keynotes, must-see Briefings tracks, and the Arsenal tools worth your badge time.
Edge runtimes strip away most of the Node.js surface area, and that's a feature, not a bug. The tighter the sandbox, the fewer places an attacker can hide.
Start with a strict Content Security Policy served from the edge itself. Because your worker owns the response, there's no upstream that can weaken it.
Next, treat every environment binding as a secret — including the ones you think are 'public'. Publishable keys leak scope information that attackers use to fingerprint your stack.
Finally, log at the boundary. A single structured line per request, shipped to your SIEM, beats a thousand console.log calls scattered across handlers.