HTTPS, SSL and TLS Explained: How Your Site Stays Secure
What actually happens when a browser shows the padlock, how certificates prove identity, why free certificates are just as secure, and how to fix mixed content and expiry problems.
Read →
Tips & writing
Notes from the workbench
Practical engineering tips, design theory and performance breakdowns — written for developers and founders who like their advice tested in production.
Filtering by tag #security — clear
Leaked an API Key on GitHub? Do This in the Next 10 Minutes
Bots scan public repositories for secrets constantly. If you pushed a key, deleting it isn't enough. The exact order of steps: revoke, check for damage, clean history, and prevent a repeat.
Read →
Web Application Security Checklist for Full Stack Developers
You don't need to be a security specialist to avoid the bugs attackers exploit most. A practical checklist covering injection, XSS, CSRF, access control, secrets, dependencies and headers.
Read →
JWT vs Session Authentication: Which One Should You Use?
JWTs are popular, but popular isn't the same as right for your app. A clear comparison of sessions and tokens, where each one shines, and the storage mistakes that create security holes.
Read →
Environment Variables Done Right: .env Files, Secrets and Config
"It works on my machine" is usually a config problem. A practical guide to .env files, public vs private variables, validation at startup, and keeping secrets out of your repo.
Read →
SSH Keys Explained: Secure Logins for Servers and Git
Passwords are the weakest way to log in to a server. How SSH keys work, how to create and use them for servers and GitHub, and the configuration that keeps your machines locked down.
Read →
Your AI-Built MVP Works. That Is the Problem.
84% of developers now use AI coding tools and only 29% trust the output. Duplication is up, refactoring has collapsed, and roughly 45% of AI-generated code ships with a security flaw. Here is how to audit an AI-built codebase before it becomes a rewrite.
Read →
File Uploads Done Right: Security, Storage and Scale
A file upload form is one of the riskiest features you can build. How to validate real file types, store files safely, upload straight to object storage, and serve user content without opening holes.
Read →
Webhooks Explained: How to Receive Them Reliably and Securely
Payment confirmations, Git pushes and form submissions often arrive as webhooks. How they work, how to verify signatures, handle retries and duplicates, and test them on your laptop.
Read →