Security
Explore encryption, authentication, and the techniques that keep systems safe.
The CIA Triad
The three properties every security decision trades against ā confidentiality, integrity, and availability.
What is TLS?
How TLS secures internet communication ā from the handshake to encrypted data transfer.
Authentication vs Authorization
Who are you, and what may you do? Two distinct concepts that get conflated constantly ā and confused at your peril.
Hashing and Encryption
The most-confused pair in security ā one is reversible, one isn't. Getting them mixed up leads to real vulnerabilities.
OWASP Top 10
The industry's consensus list of the most critical web application security risks, updated periodically to reflect real-world attack trends.
Cookies, Sessions, and JWTs
HTTP is stateless, so how does a server remember you? Cookies, server-side sessions, and JWTs each solve this differently ā with real trade-offs.
SQL Injection Deep Dive
The attack that has breached more databases than any other. How SQL injection works, why parameterized queries are the only real fix, and why it's still in the OWASP top 10 decades later.
XSS Attacks
Cross-site scripting ā injecting malicious scripts into web pages. How stored, reflected, and DOM-based XSS work, what attackers gain from them, and how to stop them.
CSRF Attacks
Cross-site request forgery ā the browser's helpfulness is the vulnerability. How attackers trick authenticated users into performing unintended actions, and how SameSite cookies changed the landscape.
OAuth 2.0
The standard for delegated authorization. How OAuth 2.0 lets users grant third-party apps access to their data without sharing passwords.
Zero Trust Architecture
Never trust, always verify. How zero trust replaces the perimeter security model and why it's become the standard for modern enterprise security.
Threat Modeling
Systematically identifying what can go wrong before it does. STRIDE, attack trees, and how to build threat modeling into your development process.
Penetration Testing Basics
Attacking systems to find weaknesses before attackers do. The methodology, tooling, and mindset behind professional penetration testing.
AI Security Risks
How AI systems introduce new attack surfaces. Prompt injection, insecure output handling, and the unique security challenges of LLM applications in production.
Securing AI-Built Products
Security considerations for products built with AI assistance. Code review, supply chain risks, and how AI-generated code changes your threat model.