The map
- Not started
- In progress
- Done
- Builds on
- 01Think like a defenderThreat modelling in half an hour0/1
- 02IdentityWho you are, what you may do0/5
- 03Application flawsOWASP Top 10, injection, access control0/3
- 04Protecting dataTLS, encryption, secrets0/3
- 05Operating securelyDependencies, logs, privilege, disclosure0/4
- 06Next: system designSame ideas, at service scale
- Rate limitingLibrary ↗Login endpoints, password resets and one-time codes all need limits on attempts. Here is how rate limiters work and where they fail.
- API gatewayLibrary ↗Many teams check tokens and enforce coarse access rules at a gateway in front of their services. See what belongs there and what still has to happen in each service.
- Sidecar and service meshLibrary ↗Mutual TLS between services is a core step towards zero trust. A mesh moves it into sidecar proxies so every service gets it without code changes.
Everything here is defensive. The JavaScript examples run in the page and are toys that show an idea (a decoded JWT, a salted hash, a constant-time comparison, log redaction); the toy hash is deliberately weak and must never be used for real passwords.
Where this path leads
- CI/CD and DevOps: from commit to production safely →Build a pipeline that tells you within minutes whether a change works, ships the exact artifact it tested, proves where that artifact came from, and rolls changes out gradually enough that a bad one reaches few users and is undone automatically.
- APIs and the edge →Shape what clients see, and keep the contract honest as both sides change.