Application Security

I treat application security as part of the architecture and of the development process, not a stage before release. I look at trust boundaries, data flow, the permission model and the attack surface, because the most dangerous flaws often come from correctly working components wired together the wrong way.

OWASP Top 10, Web Security, API Security, Authentication, Authorization, OAuth 2.0, OIDC, JWT, Session Security, Access Control, Input Validation, XSS, CSRF, SSRF, SQL Injection, IDOR, CORS, CSP, Secure Coding, Threat Modeling, SAST, DAST, Dependency Security