The Lie of the .env File
Your secrets aren't safe just because they're not in the code. They're hiding in a different place.
The Number Dispenser
Rate limiting sounds boring until it's the only thing between your system and total collapse.
The Bouncer That Confuses Everyone
CORS isn't a security feature. It's a relaxation of one. That gap is where the misconfigurations live.
The Silent Partner
Refresh tokens do the quiet work of keeping you logged in. They're also the thing nobody thinks to protect.
The Dialog Box You Never Read
That "Allow Access?" screen is doing more than you think. And sometimes less.
The Self-Signed Permission Slip
JWTs feel like freedom until you need to take one back
The Flimsy Wristband
Why the thing keeping you logged in matters more than your password
Turns Out I've Been Taking Notes
How a pile of scratch notes became whatever this is