Once by the book.
Safer code, by design.

Security goals: confidentiality, integrity, availability

Which property a control protects, and what it cannot protect.

Assets, actors, trust boundaries, and attack surface

Start from what matters, who can influence it, and where data crosses ownership.

Threat, vulnerability, exploit, impact, and risk

Distinguish a weakness from its possible use and consequence.

Authentication, authorization, and accounting

Identity proof, permission decisions, and evidence are different jobs.

Least privilege and secure defaults

Grant only the access needed; make the safe path the default.

Defense in depth and security boundaries

Layer controls without treating any single layer as a substitute for the others.

Fail open or fail closed

Choose behavior when a control or dependency is unavailable, based on the protected action.

Security by design versus security by obscurity

Keep useful design secrecy distinct from controls that must hold even when implementation is known.

Threat modeling a small feature

Identify assets, actors, boundaries, abuse cases, and the controls that change the risk.

Data-flow diagrams and trust boundaries

Draw only the flows needed to make security assumptions visible and reviewable.

STRIDE and alternative threat prompts

Use a structured prompt as a completeness aid, not as a scoring oracle.

Abuse cases and business logic

Ask how a valid feature can be misused, combined, repeated, or accessed out of sequence.

Security requirements and acceptance criteria

Turn risks into explicit, testable requirements before implementation.

Secure architecture decisions

Record assumptions, rejected options, residual risk, and revisit triggers.

Attack surface reduction

Remove unused routes, permissions, dependencies, endpoints, and data.

Third-party and integration trust

Define what each provider may send, read, change, and trigger.

Privacy and security design review

Include data minimization, user expectations, and misuse impact alongside technical controls.

Lightweight threat-model review in pull requests

Revisit the model when a change adds a new boundary, privilege, data type, or external dependency.

The browser is an untrusted client

UI state and client-side checks can improve experience but cannot authorize a server action.

Trace untrusted data end to end

Follow a value from URL, form, header, cookie, or webhook to every sink that uses it.

Parse, validate, normalize, and encode are different

Validate data for its domain; encode for the output context; avoid treating these steps as interchangeable.

Allowlist validation and bounded input

Define accepted shapes, sizes, ranges, and formats at each boundary.

Canonicalization and double-decoding bugs

Agree on one representation before validation and use; reject ambiguous encodings.

HTTP security-relevant behavior

Understand methods, status codes, headers, cookies, origins, caching, redirects, and content types as part of the security contract.

Client-side versus server-side validation

Duplicate user-friendly checks when useful, but enforce the actual security rule at the trusted boundary.

Error messages and information leakage

Return useful errors without disclosing secrets, stack traces, internal topology, or account existence unnecessarily.

Reflected, stored, and DOM-based XSS

Where attacker-controlled content enters and how it reaches an executable browser context.

Contextual output encoding

HTML text, attributes, URLs, JavaScript, CSS, and rich text require different safe handling.

Safe DOM APIs and dangerous HTML escape hatches

Prefer text and structured APIs; isolate and sanitize rich HTML when it is genuinely required.

Framework escaping and its limits

Know what a framework escapes automatically and identify raw HTML, unsafe URL, and template escape hatches.

NoSQL and search-query injection

Treat query operators and search syntax as untrusted structure, not harmless strings.

OS command injection

Avoid shell construction; call a process with argument arrays and constrained inputs when process execution is necessary.

Template, expression, and code injection

Separate data from executable templates and avoid evaluating untrusted expressions.

LDAP, XPath, and other interpreter injection

Recognize that every interpreter needs its own parameterization or safe construction strategy.

Header, CRLF, and log injection

Keep untrusted values from creating response headers, splitting messages, or forging log records.

Deserialization and object construction

Avoid unsafe polymorphic deserialization; constrain types and validate parsed data.

Prototype pollution

Prevent attacker-controlled object keys from changing inherited properties, configuration, or later authorization checks in JavaScript.

ReDoS and parser complexity

Bound input and algorithmic work so valid-looking inputs cannot monopolize CPU or memory.

Deny by default and check every request

Enforce authorization on the server for every protected operation and resource.

Function-level and administrative authorization

Protect privileged actions independently of whether a user can access the general application.

Horizontal and vertical privilege escalation

Test access across peers and across privilege levels.

RBAC, ABAC, and relationship-based policies

Choose a model that represents real ownership, attributes, roles, and relationships.

Authorization policy placement

Centralize policy enough to audit it while keeping resource ownership explicit.

Tenant isolation

Derive tenant context from a verified membership, scope every query, and add database protections where appropriate.

Mass assignment and over-posting

Bind only fields the caller is allowed to set; do not deserialize request fields directly into privileged domain state.

Time-of-check/time-of-use authorization

Keep the permission decision valid through the protected change, particularly under concurrency.

Authorization regression tests

Build a matrix of subject, resource, operation, and expected outcome; test negative cases as first-class behavior.

Delegated access and sharing links

Scope, expire, revoke, and audit capabilities that grant access outside the normal account path.

Password storage and verification

Use a maintained password-hashing function with its intended salt and work parameters; never encrypt or fast-hash passwords as a substitute.

Login abuse and credential stuffing

Combine throttling, abuse signals, MFA, and safe recovery without creating easy denial-of-service lockouts.

Multi-factor authentication and passkeys

Understand factor independence, phishing resistance, recovery, and the risk of weak fallback paths.

Account recovery and password reset

Use short-lived, single-use reset capabilities; avoid account enumeration and insecure reset questions.

Session identifiers and entropy

Generate unpredictable session identifiers with cryptographic randomness.

Cookie flags and browser session storage

Choose Secure, HttpOnly, SameSite, path, domain, and lifetime based on the session design.

CSRF and same-site request defenses

Protect cookie-authenticated state changes with an explicit request-origin strategy.

OAuth 2.0 and OpenID Connect roles

Distinguish authorization from authentication and keep client, resource server, and identity provider responsibilities clear.

API keys, bearer tokens, and signed tokens

Decide who can see a credential, its scope and lifetime, and how it is revoked; never treat a decoded token as trusted.

Service identities and workload credentials

Prefer short-lived, narrowly scoped machine identity over copied long-lived secrets.

Sensitive-action confirmation and reauthentication

Add stronger proof for account, payment, or permission changes where risk justifies it.

Data classification and minimization

Collect, retain, expose, and log only what the feature needs.

TLS, certificate validation, and trust stores

Verify peers and configure the transport; encryption without correct certificate validation is incomplete.

Encryption at rest and field-level protection

Choose what is protected from which threat and account for application access to decryption keys.

Hashing, encryption, encoding, and signing

Explain the distinct security properties each operation provides.

Cryptographically secure randomness

Use platform cryptographic APIs for tokens, reset links, and unpredictable secrets—not general-purpose PRNGs.

Key lifecycle and key management

Generate, store, grant access to, rotate, back up, and retire keys deliberately.

Timing attacks and constant-time comparison

Avoid leaking secrets through data-dependent comparison or other observable timing where constant-time primitives are appropriate.

Message authentication and digital signatures

Verify integrity and sender authenticity without confusing signatures with encryption.

Nonces, IVs, and authenticated encryption

Use library-managed, unique parameters and authenticated modes; never invent a crypto protocol.

Token and URL leakage

Keep credentials out of URLs, referrers, analytics, error reports, and logs.

Backups, deletion, and cryptographic erasure

Align copies, retention, access, and key destruction with the data lifecycle.

API authentication is not API authorization

Validate identity and separately check action and resource access.

Request size, pagination, and resource limits

Bound payloads, nested structures, result sizes, and expensive operations.

Rate limiting and abuse controls

Apply limits to the right identity and operation while considering distributed clients and shared infrastructure.

Idempotency and replay resistance

Make retries safe and protect sensitive one-time actions from replay.

Workflow and business-logic abuse

Validate allowed state transitions on the server, not just individual fields.

Price, quota, and entitlement tampering

Derive sensitive values and eligibility from trusted state.

Webhook signature verification

Verify the exact raw body and timestamp using the provider's documented scheme, then handle duplicates safely.

SSRF and server-side fetches

Restrict destinations and redirects, validate resolved addresses including cloud metadata ranges, and isolate outbound network access.

Clickjacking and framing controls

Decide which trusted origins may embed the application and set frame protections accordingly.

GraphQL and query-shape abuse

Bound depth, complexity, batching, and object-level authorization.

WebSocket and long-lived connection security

Authenticate connection setup, authorize each relevant message/action, and handle expiry and origin checks.

Redirects, callbacks, and deep links

Validate destinations against explicit rules; prevent open redirect and unsafe callback behavior.

HTTP request smuggling and parser disagreement

Investigate when a proxy and origin parse message boundaries differently, and verify consistent handling across the request path.

Web cache poisoning and cache deception

Check whether cache keys and origin behavior can store attacker-influenced content or expose a private response to other users.

Related HTTP caching and CDNs

Threat-model an LLM feature

Map user prompts, system instructions, retrieved content, model providers, tools, and sinks as separate trust boundaries.

Direct and indirect prompt injection

Understand that instructions in user input or retrieved content can manipulate model behavior; prompt wording alone is not a security boundary.

Untrusted model output and dangerous sinks

Validate and authorize structured outputs before they reach HTML, SQL, shell, URLs, code execution, or state-changing tools.

Data exfiltration through rendered output

Prevent rendered model-authored links or media from making unintended external requests that disclose sensitive context.

Related Content Security Policy deployment

Tool calls as untrusted requests

Treat every proposed tool call as data; validate its schema, caller, target, scope, and current user permissions in ordinary application code.

Agent permissions and excessive agency

Limit available tools, operation scope, autonomy, and downstream identities to what the task actually needs.

MCP and tool server security

Assess server identity, untrusted tool descriptions and results, authorization scope, and credential exposure across the client-server boundary.

Related Tool calls as untrusted requests·Agent permissions and excessive agency

Human approval for high-impact actions

Require explicit, contextual confirmation before irreversible, externally visible, or privileged actions.

Retrieval authorization and tenant isolation

Apply the requesting user's permissions before retrieval and recheck authorization before disclosing retrieved content.

Poisoned and hostile retrieved content

Treat documents, web pages, email, and tool results as untrusted context that can contain indirect instructions.

Vector stores, embeddings, and sensitive data

Protect access to source documents, derived embeddings, metadata, and retrieval results; consider leakage and cross-tenant exposure.

System prompts are not secrets

Keep credentials and access decisions out of prompts; assume instructions can be exposed and enforce controls elsewhere.

Conversation state and agent memory isolation

Scope memory to a user and task, define retention, and prevent one session's content from influencing another's.

AI provider data handling and privacy

Understand what prompts, files, telemetry, and outputs leave the system and the provider's retention and training settings.

Model, dataset, and plugin supply-chain risk

Verify provenance and permissions for models, fine-tuning data, connectors, plugins, and other components.

Unbounded token use, loops, and cost abuse

Set budgets, deadlines, output limits, and stopping rules for model calls and agent loops.

LLM security evaluations and regression tests

Test security properties across prompt variations and workflow states; retain reproducible cases while recognizing model variability.

Red-team an AI feature safely

Probe a local or authorized test system for data exposure, tool misuse, policy bypass, and resource abuse.

AI security incident response

Preserve relevant prompts, tool-call decisions, retrieved sources, model/provider versions, and outcomes without logging unnecessary sensitive content.

Turn a threat into a test

Express the expected security property as a testable invariant.

Negative authorization tests

Assert that the wrong user, tenant, role, or workflow state is rejected.

Unit, integration, and end-to-end security tests

Place each check where it can exercise the real boundary without overclaiming coverage.

Regression tests for vulnerabilities

Preserve a minimal failing input and prove the fixed behavior at the relevant layer.

Static analysis and lint rules

Use tools to find classes of mistakes; triage findings and understand blind spots.

Dynamic and interactive application testing

Exercise a running test deployment safely and interpret scanner results rather than treating them as proof.

Fuzzing parsers and validators

Generate unexpected inputs to find crashes, hangs, and invariant failures.

Dependency and container scanning

Track components and investigate findings in the context of actual usage and exposure.

Secure code review checklist

Follow sources, trust boundaries, sinks, authorization decisions, secrets, and failure paths.

False positives, false negatives, and test coverage

Understand why scanners and passing tests cannot establish that an application is secure.

Security test environments and safe fixtures

Use synthetic data, scoped credentials, and isolated targets; do not test real systems without authorization.

Secure file upload pipeline

Enforce size, type, content, storage, and authorization checks as separate controls.

MIME type and extension validation

Treat client-provided filenames and content types as claims, not evidence.

Safe file names and storage locations

Generate server-side names and keep untrusted content out of executable or public paths.

Malware scanning and quarantine workflow

Define pending, scanned, rejected, and available states without trusting a scan as perfect.

Archive extraction and path traversal

Prevent entries from escaping the intended destination and bound expansion.

Image, document, and media parser risks

Isolate complex parsers and apply resource limits and updates.

Content-Disposition and download safety

Serve untrusted files with deliberate content types and download behavior.

Import, export, and CSV formula injection

Treat exported values as active content when opened by spreadsheet software.

XML external entities and unsafe XML features

Disable unnecessary entity resolution and bound parsing.

Rich text sanitization and safe rendering

Define allowed markup, sanitize with maintained tooling, and preserve context-safe rendering.

Dependency inventory and transitive risk

Know what is in the build, where it came from, and which paths execute it.

Vulnerability advisories and triage

Consider affected versions, reachability, exposure, available fixes, and compensating controls.

Lockfiles, registries, and package confusion

Pin expected sources and prevent untrusted packages or namespaces from entering a build.

Dependency updates and patch policy

Automate discovery while retaining review, testing, and a way to respond quickly.

Secrets committed to source control

Detect exposed credentials, revoke and rotate them immediately, and remove them from future history without mistaking history rewriting for revocation.

Typosquatting and malicious packages

Verify package identity and provenance before adding dependencies.

Build isolation and reproducibility

Reduce ambient access and make artifacts traceable to reviewed source and build inputs.

SBOMs and component provenance

Produce useful component and build-origin records; distinguish inventory from a security guarantee.

Artifact signing and verification

Establish who produced an artifact and verify integrity at consumption.

CI/CD secret exposure

Use scoped, short-lived credentials and keep untrusted pull requests away from privileged secrets.

Pipeline permissions and workflow injection

Treat workflow files, actions, build scripts, and user-controlled parameters as executable attack surface.

Third-party actions, plugins, and build extensions

Pin and review external code that runs with pipeline privileges.

Coordinated vulnerability disclosure and patch response

Provide a safe reporting path, assess impact, ship fixes, and communicate clearly.

Same-origin policy and origin model

Understand scheme, host, and port as browser isolation boundaries.

CORS preflight and credentialed requests

Configure explicit origin and credential behavior without using wildcard shortcuts for private data.

postMessage and cross-window messaging

Validate sender origin, source window, and message shape before trusting data from popups, frames, or embedded widgets.

Browser storage trade-offs

Compare cookies, local storage, session storage, and in-memory state by threat and use case.

Content Security Policy deployment

Start with report-only observation, remove unsafe allowances, and test real application flows.

Subresource Integrity and third-party scripts

Reduce the risk of changed remote assets and minimize the scripts trusted with page access.

Referrer, permissions, and security headers

Set browser policy deliberately and verify actual deployed responses.

DOM clobbering and unsafe URL schemes

Avoid named-property collisions and validate navigable or executable URLs.

Cross-site leaks and side channels

Recognize that observable response differences can expose sensitive state across origins.

Privacy-preserving telemetry

Avoid collecting secrets and sensitive personal data in analytics, logs, or replay tools.

Consent, retention, deletion, and export

Implement user-facing data promises as backend behavior, not only interface copy.

Security configuration and hardened defaults

Make secure configuration explicit, reviewable, environment-specific, and checked at startup.

Least privilege for application processes

Limit database, filesystem, network, cloud, and operating-system permissions.

Memory safety and unsafe code

Understand where unsafe and native boundaries—from Rust unsafe and Go cgo to Node extensions—bypass language safeguards and require explicit review.

Environment variables and secret stores

Know exposure paths and choose a managed secret mechanism appropriate to deployment.

Containers and image hygiene

Run as non-root where possible, minimize images, pin sources, and scan the resulting artifact.

Network segmentation and egress control

Limit which components can reach each other and where an application can connect outbound.

Cloud IAM and workload identity

Grant narrowly scoped access through identities rather than embedded static keys.

Database account and network security

Separate application roles, restrict reachable services, and avoid administrative credentials at runtime.

Production and non-production separation

Keep real data and production secrets out of developer machines, previews, and test fixtures.

Backups, restore, and ransomware resilience

Protect backup access and prove recovery rather than assuming that a backup is usable.

Patch management and exposed services

Inventory reachable components, prioritize fixes, and retire unused services.

Infrastructure as code review

Treat permissions, network rules, storage exposure, and deployment configuration as code requiring review and tests.

Security event logging

Record enough evidence to investigate while excluding credentials, tokens, and unnecessary personal data.

Authentication and authorization signals

Capture useful events and context for detecting abuse without treating every failure as an incident.

Log integrity, access, and retention

Protect logs from tampering, limit readers, and keep them only as long as justified.

Alert quality and operational ownership

Give each alert a clear signal, severity, responder, and first action.

Vulnerability triage and severity

Combine technical severity with reachability, exploitability, affected assets, and business impact.

Incident response roles and first steps

Preserve evidence, contain impact, communicate, and restore service through a prepared process.

Credential and key compromise

Revoke, rotate, identify use, invalidate sessions, and check downstream copies.

Security incident retrospectives

Identify control and process gaps without reducing the review to blame or one patch.

Vulnerability disclosure handling

Receive reports safely, acknowledge them, reproduce in authorized environments, and coordinate a fix.

Tabletop exercises and response readiness

Rehearse realistic scenarios and record what people, access, or telemetry were missing.

Security policies versus implemented controls

A written policy is not evidence that a control works in code or operations.

Secure development lifecycle

Place requirements, review, testing, release, and vulnerability response across the software lifecycle.

OWASP ASVS as a verification catalog

Use versioned requirements to plan and check web application controls; scope the verification level to the system.

OWASP Top 10 and common risk taxonomies

Use risk lists as awareness and prioritization aids, not complete curricula or pass/fail standards.

NIST SSDF practices in a small team

Translate outcome-oriented secure development practices into proportionate team habits.

Evidence, audit trails, and control ownership

Connect a control to a person, system evidence, review cadence, and remediation process.

Risk acceptance and exceptions

Record who accepts residual risk, for how long, with what compensating controls and review date.

Security roles and shared responsibility

Clarify product, engineering, operations, security, and provider responsibilities.

CompTIA Security+ crosswalk

Optional exam-oriented index for applicable security foundations, threats, architecture, operations, and governance topics.

CompTIA CySA+ crosswalk

Optional analyst-oriented index for monitoring, vulnerability management, incident response, and threat analysis.

Exam objective versioning

State the exam code and objectives version beside every mapping; never imply the catalog alone prepares someone to pass.

Jurisdiction- and standard-specific compliance

Link out to separately maintained, dated material rather than presenting one universal compliance checklist.