Security
Your dependencies are your attack surface: a supply-chain security checklist
Most of the code you ship, you didn't write. A short, practical checklist for keeping third-party packages from becoming your next incident.
Security Correspondent
Samuel Brandt
Reports on application security, supply-chain risk and observability.
DevOps
Logs, metrics and traces — what each one is actually for
The "three pillars" of observability answer different questions. Knowing which one to reach for saves hours during an incident.
Security
SQL injection is still here. Parameterized queries still fix it
One of the oldest web vulnerabilities keeps showing up in new code. The fix has been known for decades — here's how to apply it everywhere, including the places ORMs don't cover.
Security
Storing passwords safely: slow hashes, salts and what not to do
If your user table leaks, how you hashed passwords decides whether attackers get a list of emails or a list of working logins.
Security
CSRF in the age of SameSite cookies
Browsers now block many cross-site requests by default. That helps, but it doesn't make CSRF tokens obsolete.
Security
Content Security Policy without breaking your site
CSP is one of the most effective defenses against cross-site scripting. Rolling it out gradually is the difference between protection and a broken checkout page.
Security
Secrets management for small teams
API keys in the repo, passwords in chat, one shared admin login. A practical path from secret sprawl to something you can actually audit and rotate.
Security
Rate limiting algorithms: token bucket, fixed window and sliding window
Rate limits protect logins from brute force and APIs from overload. The algorithm you choose decides how bursty traffic is treated.
DevOps
SLOs and error budgets: deciding how reliable is reliable enough
100% uptime is the wrong goal. Service level objectives turn reliability into a number you can plan around, and error budgets tell you when to slow down.
DevOps
Structured logging: making logs you can actually query
Free-form log lines are easy to write and painful to search. Emitting events with consistent fields turns logs into data.
Security
Threat modeling for small teams in an afternoon
You don't need a security department to think like an attacker. A lightweight, repeatable session finds the risks worth fixing before they ship.
Security
Signing commits and build artifacts: proving where code came from
Anyone can set their git author name to yours. Signatures let you verify who actually made a commit, and which pipeline produced a release.