application and product security 113
- A Team Playbook for Improving AI-Enabled Application Security
- Operating AI-Enabled Application Security: Ownership, Evidence, and Exceptions
- Engineering AI-Enabled Application Security into the Paved Road
- An Architecture Review Playbook for AI-Enabled Application Security
- AI-Enabled Application Security: What the Team Must Decide Before Building
- How to Lead a Review of Privacy Engineering
- Measuring Privacy Engineering Without Vanity Metrics
- Turning Requirements for Privacy Engineering into Delivery Guardrails
- Designing Privacy Engineering: Trust Boundaries, Failure Modes, and Tradeoffs
- A Practical Risk Model for Privacy Engineering
- A Practical Failure Exercise for Abuse Cases and Fraud Resistance
- Abuse Cases and Fraud Resistance in Production: Signals That Show the Control Works
- Implementing Abuse Cases and Fraud Resistance Without Slowing Delivery
- Failure Modes in Abuse Cases and Fraud Resistance: A Design-Level Analysis
- Defining the Security Outcome for Abuse Cases and Fraud Resistance
- How to Lead a Review of Penetration Testing as an Engineering Input
- Measuring Penetration Testing as an Engineering Input Without Vanity Metrics
- Turning Requirements for Penetration Testing as an Engineering Input into Delivery Guardrails
- Designing Penetration Testing as an Engineering Input: Trust Boundaries, Failure Modes, and Tradeoffs
- A Practical Risk Model for Penetration Testing as an Engineering Input
- A Practical Failure Exercise for Security-Focused Code Review
- Security-Focused Code Review in Production: Signals That Show the Control Works
- Implementing Security-Focused Code Review Without Slowing Delivery
- Failure Modes in Security-Focused Code Review: A Design-Level Analysis
- Defining the Security Outcome for Security-Focused Code Review
- A Team Playbook for Improving Secure Legacy Modernization
- Operating Secure Legacy Modernization: Ownership, Evidence, and Exceptions
- Engineering Secure Legacy Modernization into the Paved Road
- An Architecture Review Playbook for Secure Legacy Modernization
- Secure Legacy Modernization: What the Team Must Decide Before Building
- A Team Playbook for Improving Ruby on Rails Security
- Operating Ruby on Rails Security: Ownership, Evidence, and Exceptions
- Engineering Ruby on Rails Security into the Paved Road
- An Architecture Review Playbook for Ruby on Rails Security
- Ruby on Rails Security: What the Team Must Decide Before Building
- How to Lead a Review of Webhooks, Jobs, and File Processing
- Measuring Webhooks, Jobs, and File Processing Without Vanity Metrics
- Turning Requirements for Webhooks, Jobs, and File Processing into Delivery Guardrails
- Designing Webhooks, Jobs, and File Processing: Trust Boundaries, Failure Modes, and Tradeoffs
- A Practical Risk Model for Webhooks, Jobs, and File Processing
- A Practical Failure Exercise for Cryptographic Engineering
- Cryptographic Engineering in Production: Signals That Show the Control Works
- Implementing Cryptographic Engineering Without Slowing Delivery
- Failure Modes in Cryptographic Engineering: A Design-Level Analysis
- Defining the Security Outcome for Cryptographic Engineering
- A Team Playbook for Improving OAuth and OpenID Connect
- Operating OAuth and OpenID Connect: Ownership, Evidence, and Exceptions
- Engineering OAuth and OpenID Connect into the Paved Road
- An Architecture Review Playbook for OAuth and OpenID Connect
- OAuth and OpenID Connect: What the Team Must Decide Before Building
- How to Lead a Review of Zero Trust for Applications
- Measuring Zero Trust for Applications Without Vanity Metrics
- Turning Requirements for Zero Trust for Applications into Delivery Guardrails
- Designing Zero Trust for Applications: Trust Boundaries, Failure Modes, and Tradeoffs
- A Practical Risk Model for Zero Trust for Applications
- A Practical Failure Exercise for Microservice Trust
- Microservice Trust in Production: Signals That Show the Control Works
- Implementing Microservice Trust Without Slowing Delivery
- Failure Modes in Microservice Trust: A Design-Level Analysis
- Defining the Security Outcome for Microservice Trust
- A Team Playbook for Improving SaaS and Integration Security
- Operating SaaS and Integration Security: Ownership, Evidence, and Exceptions
- Engineering SaaS and Integration Security into the Paved Road
- An Architecture Review Playbook for SaaS and Integration Security
- SaaS and Integration Security: What the Team Must Decide Before Building
- How to Lead a Review of Security Design Review Programs
- Measuring Security Design Review Programs Without Vanity Metrics
- Turning Requirements for Security Design Review Programs into Delivery Guardrails
- Designing Security Design Review Programs: Trust Boundaries, Failure Modes, and Tradeoffs
- A Practical Risk Model for Security Design Review Programs
- A Practical Failure Exercise for Secure Architecture
- Secure Architecture in Production: Signals That Show the Control Works
- Implementing Secure Architecture Without Slowing Delivery
- Failure Modes in Secure Architecture: A Design-Level Analysis
- Defining the Security Outcome for Secure Architecture
- A Team Playbook for Improving API Security
- Operating API Security: Ownership, Evidence, and Exceptions
- Engineering API Security into the Paved Road
- An Architecture Review Playbook for API Security
- API Security: What the Team Must Decide Before Building
- How to Lead a Review of Output Encoding and Browser Security
- Measuring Output Encoding and Browser Security Without Vanity Metrics
- Turning Requirements for Output Encoding and Browser Security into Delivery Guardrails
- Designing Output Encoding and Browser Security: Trust Boundaries, Failure Modes, and Tradeoffs
- A Practical Risk Model for Output Encoding and Browser Security
- A Practical Failure Exercise for Input Validation and Injection Prevention
- Input Validation and Injection Prevention in Production: Signals That Show the Control Works
- Implementing Input Validation and Injection Prevention Without Slowing Delivery
- Failure Modes in Input Validation and Injection Prevention: A Design-Level Analysis
- Defining the Security Outcome for Input Validation and Injection Prevention
- A Team Playbook for Improving Session Security
- Operating Session Security: Ownership, Evidence, and Exceptions
- Engineering Session Security into the Paved Road
- An Architecture Review Playbook for Session Security
- Session Security: What the Team Must Decide Before Building
- How to Lead a Review of Authorization
- Measuring Authorization Without Vanity Metrics
- Turning Requirements for Authorization into Delivery Guardrails
- Designing Authorization: Trust Boundaries, Failure Modes, and Tradeoffs
- A Practical Risk Model for Authorization
- A Practical Failure Exercise for Authentication
- Authentication in Production: Signals That Show the Control Works
- Implementing Authentication Without Slowing Delivery
- Failure Modes in Authentication: A Design-Level Analysis
- Defining the Security Outcome for Authentication
- A Team Playbook for Improving Threat Modeling
- Operating Threat Modeling: Ownership, Evidence, and Exceptions
- Engineering Threat Modeling into the Paved Road
- An Architecture Review Playbook for Threat Modeling
- Threat Modeling: What the Team Must Decide Before Building
- How to Lead a Review of Security-First Product Engineering
- Measuring Security-First Product Engineering Without Vanity Metrics
- Turning Requirements for Security-First Product Engineering into Delivery Guardrails