new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

cache/isolation

6 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Prefix all cache keys with hashed tenant identifier

Cache keys must include tenant isolation. Use format t:{tenant_hash}:{key} where tenant_hash is hashlib.sha256(tenant_id.encode()).hexdigest()[:16]. Validate cache key format to prevent injection by rejecting keys containing {, }, newlines, or carriage returns.

Embed and verify tenant_id in cached data for defense in depth

Store cached values as JSON objects with structure {"_tenant_id": tenant_id, "value": actual_value}. On retrieval, verify that data._tenant_id matches the current tenant_id. If mismatch is detected, delete the cache entry immediately as potentially poisoned.

Set appropriate TTLs on tenant cache entries

Configure cache entries with reasonable time-to-live values to prevent stale data persistence. Default TTL should be 3600 seconds; security-sensitive data should use shorter TTLs.

Implement tenant cache invalidation method to purge all tenant entries

Implement invalidate_tenant(tenant_id) method that scans Redis with pattern t:{tenant_hash}:* and deletes all matching keys in batches of 1000. Use cursor-based iteration with redis.scan() to avoid blocking.

Use @tenant_cached decorator for transparent caching with isolation

Create a decorator @tenant_cached(key_template, ttl=3600) that automatically caches function results per-tenant. The decorator should check cache before execution, return cached value if present, execute function if cache miss, then set cache with result before returning.

Do not use shared cache keys without tenant prefixes

Avoid cache key formats like 'user:{user_id}' or 'session:{session_id}' that don't include tenant prefix. Always use format like t:{tenant_hash}:{key}.

Give your agent this brain