Security

The attacks every developer must know — injection, XSS, CSRF, SSRF, deserialization — and the defensive habits that neutralize them.

Who you are vs. what you may do — sessions, JWTs, OAuth2/OIDC flows, MFA, and authorization models that scale.

How SSL/TLS actually works — the handshake, the certificate/PKI trust architecture, and operating certificates in practice.

Finding what can go wrong before building it — assets, trust boundaries, STRIDE, and keeping the practice lightweight.

Keeping credentials out of code and alive in production — vaults, rotation, short-lived credentials, and the leak-response playbook.

What to use, not how to build it — the primitive families, the misuse traps, and the boring right answers.

saved external articles on security topics.

curated build projects that drill the security concepts hands-on.