Blog
Security · Identity · Engineering
LATEST
LangChain, LangGraph, and LlamaIndex — Which Tool Do You Need, and When
Three dominant frameworks for building LLM-powered applications, each with a different abstraction model and production sweet spot — here is how to read the map.
ALL ARTICLES — 17 POSTS
Application SecurityOWASP Top 10 for LLM Applications — Explained with Examples
A technical walkthrough of every item on the OWASP Top 10 for LLM Applications 2025, with concrete attack examples and mitigations for developers building AI-powered systems.
Security StandardsThe Standard That Actually Defines Secure Web Applications — OWASP ASVS 5.0
A practical breakdown of what ASVS 5.0 is, how its three verification levels work, and how real teams use it — not just read it.
AuthenticationWebAuthn Passkeys in Enterprise SSO — Protocol Mechanics, IdP Integration, and Real Adoption Challenges
Passkeys are phishing-resistant by design, but enterprise adoption hits friction at the protocol boundary between WebAuthn, OIDC, and SAML — here is what that friction looks like and how to work through it.
SecurityPKCE Demystified — What the RFC Actually Says
PKCE is mandatory for public OAuth clients. Here is what the RFC actually specifies — the entropy requirements, the S256 transform, and why "plain" exists but should never be used.
Application SecurityData Protection, Secure Architecture, Logging, and WebRTC — ASVS 5.0 V14–V17
PII handling, browser storage security, dependency hygiene, security logging requirements, and WebRTC security — the final four chapters of OWASP ASVS 5.0.
Application SecurityCryptography, TLS, and Configuration Hardening — ASVS 5.0 V11, V12 & V13
Algorithm choices, key management, TLS configuration, security headers, and dependency hygiene — what OWASP ASVS 5.0 requires for the infrastructure security layer.
Application SecurityAuthorization Controls and Secure File Handling — ASVS 5.0 V8 & V5
IDOR, forced browsing, privilege escalation, and upload security — what OWASP ASVS 5.0 requires for authorization enforcement and file handling.
AuthenticationJWT Security and OAuth 2.0/OIDC Requirements — ASVS 5.0 V9 & V10
Algorithm confusion, missing claim validation, PKCE, refresh token rotation — what OWASP ASVS 5.0 requires for self-contained tokens and OAuth/OIDC implementations.
AuthenticationAuthentication and Session Management Requirements — ASVS 5.0 V6 & V7
Passwords, MFA, credential storage, session tokens, cookie attributes, and logout behavior — what OWASP ASVS 5.0 requires for authentication and sessions.
Application SecuritySecuring the Browser Layer and Your APIs — ASVS 5.0 V3 & V4
CSP, CORS, DOM XSS, mass assignment, GraphQL depth limits — what OWASP ASVS 5.0 actually requires for web frontends and API security.
Application SecurityEncoding, Validation, and Why the Order Matters — ASVS 5.0 V1 & V2
OWASP ASVS 5.0 separates output encoding from input validation for good reason. Here's what each chapter requires and how they work together to prevent injection.
SecurityA Quick JWT Overview for Developers and Security Practitioners (Part 1)
Most developers treat a JWT as a signed JSON blob. The RFC has a more precise definition — and the gap between the two is where most vulnerabilities live.
SecurityOWASP Session Management — Condensed
The OWASP cheat sheet distilled: the eight things that actually matter and the mistakes teams make when they skip them.
SecurityToken Exchange — The OAuth Flow Nobody Talks About (Until They Need It)
RFC 8693 solves a specific problem that every microservice architecture eventually hits: how to propagate identity across service boundaries without sharing raw tokens.
SecurityOAuth 2.0 for Native Apps — 7 Things to Watch Out For
RFC 8252 is sixteen pages. The gaps between the lines are where the bugs live — and they are the kind of bugs that end up in security incident reports.
DevOpsCreate artifacts easily on the GitHub Container Registry
Setting a backend up in Docker and publishing the image to GitHub Container Registry lets you run the exact same code on your laptop, CI, or production server.