Security
Postgres Row-Level Security for Multi-Tenant Applications
How to enforce tenant isolation at the database layer with Postgres RLS instead of relying on application code to remember a WHERE clause.
·4 min read
Tags
Security
28 articles · Page 1 of 3
Security
Web Security for Developers: The Essentials You Can't Skip
The security vulnerabilities that appear most often in web applications, explained with real code examples and concrete fixes every developer should know.
·3 min read
Security
Securing API Keys and Secrets in Frontend Applications
Protect API keys in frontend applications with backend proxies, token vaulting, environment hygiene and runtime injection — never in a browser bundle.
·4 min read
Security
OAuth 2.0 and OpenID Connect: A Practical Guide
Implement OAuth 2.0 and OpenID Connect correctly: authorization code flow with PKCE, token management, refresh rotation and the pitfalls behind takeovers.
·4 min read
Security
Supply Chain Security: Dependencies, Builds and Trust
A complete guide to securing your software supply chain: dependency auditing, lockfile integrity, build hardening, SBOM generation and artifact provenance.
·4 min read
Security
Serverless Security: Attack Surfaces and Mitigations
The security challenges unique to serverless: injection through event sources, over-permissioned functions and dependency risk, with practical mitigations.
·5 min read
Security
Securing Secrets in CI/CD Pipelines
Protect credentials in CI/CD pipelines with secret managers, environment isolation, least-privilege access and audit trails — without slowing deploys.
·6 min read
Security
API Defense in Depth: Rate Limits, Validation, Headers
API security layers beyond auth: rate limiting, request validation, output encoding, security headers and audit logging, with TypeScript middleware.
·5 min read
Security
Supply Chain Security for Software Dependencies
Protect your supply chain with dependency pinning, lockfile integrity checks, SBOM generation, automated scanning and third-party risk monitoring.
·4 min read
Security
Secrets Management Patterns for Cloud-Native Applications
Robust secrets management with HashiCorp Vault, AWS Secrets Manager and sealed secrets: rotation, injection, least privilege and no secret sprawl.
·5 min read
Security
OAuth 2.0 Token Security: Storage, Rotation, and Revocation
Secure OAuth 2.0 token lifecycle management: storage strategies, automatic rotation with refresh tokens, revocation propagation and replay protection.
·5 min read
Security
Runtime Application Self-Protection (RASP) for Node.js
Runtime security patterns that detect and block attacks from inside your Node.js application: SQL injection detection, path traversal and anomaly alerting.
·4 min read