Security
The threats, the defaults, and the habits that keep you out of the news.
Watch it animated → Interactive, click-through walkthroughs for Security concepts.Basic
What "Security" Even Means (Threat Modeling Basics) Security is protecting confidentiality, integrity, and availability against people who want your system to break - and threat modeling is just four plain questions that turn that vague worry into a plan.
How Passwords Should Be Stored (Hashing) Never store passwords in plain text. Store a one-way hash made with a slow, salted, password-specific algorithm like bcrypt, scrypt, or Argon2 - so a stolen database doesn't hand attackers everyone's password.
CORS, Explained (and Why It Keeps Blocking You) What CORS actually is - the browser protecting users by refusing to let one site read another's responses - how to read the error and the headers, and how to fix it on the server without opening a security hole.
Two-Factor Authentication, Explained Why a password alone isn't enough anymore, how the common second factors actually work under the hood, and which ones to trust with your real accounts.
Intermediate
Auth vs Authz (Sessions, JWT, OAuth) Authentication is proving who you are; authorization is what you're allowed to do - and after login, the server keeps you logged in with either a server-side session or a stateless token like a JWT. This guide untangles all of it, plus OAuth and 'Sign in with Google'.
HTTPS / TLS, Explained What the padlock in your browser actually means: how TLS adds encryption, integrity, and server authentication on top of plain HTTP, how the handshake agrees on a key, and how certificates and Certificate Authorities decide who to trust.
SQL Injection & XSS, Explained The two classic injection holes share one root cause - user input getting treated as code - and one cure: keep data as data. Learn the mental model, then how to close SQL injection with parameterized queries and XSS with context-aware output encoding.
The OWASP Top 10, Explained What OWASP and the Top 10 actually are - a shared checklist and vocabulary for the most common, most damaging ways web apps get broken into, and how to use it without fooling yourself into a false sense of security.
Secrets Management (Don't Commit Your Keys) What counts as a secret and why it leaks, how to keep API keys and passwords out of your code and out of Git, and how teams store, inject, and rotate secrets safely in production.
Supply-Chain Security Your dependencies are your attack surface: the npm install that owned you, lockfiles, typosquatting, and how to trust code you did not write.
Security Headers: CSP, HSTS, and Friends The HTTP response headers that harden a website - Content-Security-Policy, HSTS, and the rest - explained by the exact attack each one stops.
Advanced
Threat Modeling a Real System How to systematically find the security gaps in a whole system - not one vulnerability at a time, but by drawing the data flows, marking trust boundaries, and working through STRIDE against a real example: a file-sharing app with uploads, accounts, and payments.