Security by Design

The parts you cannot bolt on afterwards: threat models, identity boundaries, secrets, supply chain, and least privilege.

Threat Modeling in One Hour

Four questions, a whiteboard, and the people who built it. Skip the formal methodology; keep the habit.

Identity, Authentication, Authorisation

Authentication is who you are. Authorisation is what you may do. Most breaches are failures of the second one.

Secrets and Key Management

The best secret is the one that does not exist. Failing that, make it short-lived and rotatable without a deploy.

Supply Chain: Dependencies, SBOM, Signing

Most of your code was written by strangers. The question is what you know about it and what it can reach.

Least Privilege and Auditability

Design so that a compromised component reaches almost nothing, and so that you can prove what happened.