36 docs tagged with "security"

Use stable façades and information hiding to manage complexity, evolve safely, and enforce boundaries

Secure APIs with authentication, authorization, and scope management

Maintain immutable audit trails of all data access and modifications

Practical reference guides and checklists for software architecture reviews, decisions, and operational excellence. Templates for ADRs, threat modeling, API reviews, and production readiness.

Master the discipline of separating configuration from code for flexibility and safety.

TL;DR

Manage data through its lifecycle: retention, privacy, erasure, and audit trails

Populate test environments safely by masking sensitive data and using synthetic alternatives.

TL;DR

TL;DR

TL;DR

TL;DR

Registry strategies, versioning, scanning, and garbage collection

TL;DR

Understanding injection attacks, cross-site scripting, server-side request forgery, and remote code execution through real-world examples and mitigation strategies.

Protect systems through rigorous input validation and defensive programming practices.

Define crisp boundaries and explicit, testable contracts to decouple teams and evolve systems safely.

Manage log lifecycle responsibly: comply with regulations, protect sensitive data, and optimize retention periods.

Design data isolation strategies for SaaS systems: shared vs dedicated resources

Zero-trust networking, encryption in transit, and certificate management

TL;DR

Load balancing, network policies, mTLS, and CDN/edge patterns

Identify, classify, and protect personally identifiable information

Image and artifact management, supply-chain security, cost controls, and resource quotas

Enforce infrastructure standards and security policies automatically; prevent non-compliant deployments.

TL;DR

Software bill of materials, code attestation, and secure artifact provenance

Manage credentials, API keys, and configuration safely; never commit secrets to version control.

TL;DR

Find and fix vulnerabilities before attackers do through automated scanning, manual testing, and fuzzing.

Identify stakeholders, elicit their concerns, and reconcile trade-offs into architecture decisions

STRIDE-based threat modeling framework for identifying security vulnerabilities. Includes asset identification, attack surface analysis, threat enumeration, risk scoring, and mitigation planning.

Master systematic threat identification frameworks

TL;DR

Push events to external systems reliably with webhooks

Master event-driven integrations: webhooks for server-initiated callbacks, signing for security, and handling idempotency and retries.