Security

These security engineering guides help backend teams build safer systems. They cover code, cloud and AI.

The work splits into tracks. First, application security covers injection, TLS and auth. Then cloud security handles IAM. Also, AI security looks at new risks from agents.

13 articles

15/01/2023 10 min read

JWT Rotation and Revocation: Secure Token Lifecycle in Distributed Systems

JWT Rotation and Revocation keeps distributed APIs safe after a key leak. Learn short lifetimes, key ids, denylists, and refresh reuse detection in production.
28/03/2022 10 min read

DDoS Protection for Backend Systems: Layers, Rate Limiting, and Resilience

DDoS Protection for Backend Systems keeps your API up under traffic floods. Learn edge filters, rate limits, autoscaling…
26/12/2019 9 min read

OAuth 2.0 and OIDC for Backend Engineers: Flows, Tokens, and Common Mistakes

OAuth 2.0 and OIDC explained for backend services. Learn code flow with PKCE, client credentials, token checks, and…
02/10/2019 10 min read

WAF in Modern Backends: Rules, Bypass Risks, and Defense in Depth

WAF in Modern Backends stops bad requests before your app. Learn rule design, false positives, logging, and how…
04/09/2019 10 min read

SSRF Attacks and Defenses: URL Parsing, Allowlists, and Cloud Metadata

SSRF Attacks and Defenses stop your servers from fetching attacker URLs. Learn allowlists, DNS checks, metadata blocks, and…
20/01/2019 9 min read

IAM for Backend Engineers: Roles, Policies, and Least-Privilege Design

IAM for Backend Engineers shows how roles and policies limit blast radius. Learn least privilege, short sessions, and…
20/10/2018 10 min read

Encryption at Rest: Key Management, Envelope Encryption, and Compliance

Encryption at Rest protects disks, backups, and columns when storage is copied. Learn envelope keys, KMS control, rotation,…
15/09/2018 10 min read

Encryption in Transit: mTLS, TLS Termination, and Service-to-Service Security

Encryption in Transit protects service calls from network snooping. Learn TLS termination, mTLS, cert rotation, and the gaps…
01/08/2018 10 min read

TLS for Backend Engineers: Handshakes, Certificates, and Production Hardening

TLS for Backend Engineers covers handshakes, certificates, and trust stores. Learn TLS 1.3 settings, rotation, and the failures…
15/01/2018 10 min read

CORS Explained for Backend Engineers: Preflight, Credentials, and Security Pitfalls

CORS Explained for Backend Engineers covers origins, preflight, and credentials. Learn which headers to set, which to avoid,…
20/11/2017 10 min read

CSRF Protection: Tokens, SameSite Cookies, and Modern Browser Defenses

CSRF Protection stops forged state changes from other sites. Learn tokens, SameSite cookies, and where browser defaults still…
15/10/2017 10 min read

SQL Injection Prevention: Parameterized Queries, ORMs, and Defense in Depth

SQL Injection Prevention keeps queries bound to data, not to raw strings. Learn parameters, ORM limits, least privilege,…
01/09/2017 10 min read

XSS Prevention for Backend Engineers: Output Encoding, CSP, and Trust Boundaries

XSS Prevention for Backend Engineers covers encoding, CSP, and trust lines. Learn where output must be escaped and…