Web application security articles
Offensive and defensive security for builders.
Practical writing on how web applications break, how teams defend them, and how security engineers can turn reviews, threat models, and hardening work into useful engineering outcomes.
Primary topics
Featured
Start here
Application Security: Understanding Threat Modeling for Modern Security Reviews
A practical guide to using threat modeling to keep security reviews useful, focused, and tied to real engineering decisions.
So You Got Hacked: Whose Fault Is It?
A plain-language look at accountability after a breach, and how teams can turn blame into better engineering habits.
Latest blogs
Web, application, and cloud security notes
How to Optimize Docker Images for Speed & Security
Security-first techniques for building container images that are lean, fast, and easier to harden.
Threat Modeling with STRIDE: A Practical Walkthrough
A walkthrough of STRIDE using a simple web application architecture, designed for teaching and real-world review sessions.
What is an API? A Beginner’s Guide
A simple explanation of APIs and how applications communicate, useful groundwork for web application security thinking.
How to Start Your Career in Cybersecurity: A Friendly Guide
A beginner-friendly path into cybersecurity, including how to learn the fundamentals without getting lost in noise.