Security References
Structured documentation for application security, authentication, cryptography, and the attack patterns every engineer should recognize.
Application Security
OWASP Top 10
The most critical web application security risks. What they are, why they matter, how to mitigate.
SQL Injection
How injection happens, classic and second-order variants, and the only real defense.
Cross-Site Scripting (XSS)
Reflected, stored, and DOM-based XSS — encoding, sanitization, CSP.
Cross-Site Request Forgery
How CSRF works, SameSite cookies, double-submit tokens, and the modern defaults.
Content Security Policy
Writing a useful CSP — sources, nonces, hashes, and report-only mode.
Authentication & Authorization
Authentication Methods
Basic, Bearer, API keys, sessions, OAuth 2.0, OIDC, mTLS — comparison and use cases.
OAuth 2.0 Flows
Authorization Code, PKCE, Client Credentials, Device Code — when each one is correct.
JWT Structure
Anatomy of a JSON Web Token — header, payload, signature, and common claims.
SSH Key Authentication
How public key auth replaces passwords. Key types, agents, and best practice.