Security
This folder has no README. Everything inside it is listed below.
Notes
- OWASP Top 10 (2025) The most common application security risks, in the OWASP Top 10:2025 numbering.
- SQL injection 5 SQL injection happens when input becomes part of the SQL text instead of a value inside it.
- XSS and CSRF Two of the oldest web vulnerabilities. Defenses are well-known but easy to bypass when frameworks are misused.
- Password hashing You don't store passwords. You store the output of a one-way function such that even with the database, an attacker has to do work proportional to the…
- OAuth 2.0 and OpenID Connect 9 There are six or so grant types and the honest answer is that you should use one of them, almost always.
- JWT pitfalls 6 The signature verified. What could still be wrong?
- Secrets management and rate limiting Two often-bundled topics in interviews under "what does production-ready security look like."
- Pickle, YAML, and Deserialization Attacks (Python-Specific) 6 The Python ecosystem has two famous footguns: pickle.loads(...) and yaml.load(...) (without SafeLoader).
- SSRF and Command Injection 6 Two of the most common Python web app vulnerabilities.
- CORS — The Deep Dive 7 CORS (Cross-Origin Resource Sharing) is one of the most misunderstood browser security mechanisms.
- SOC 2, ISO 27001 and GRC for engineers 5 Compliance appears in senior backend job descriptions because a company selling to enterprises cannot close deals without it.
- Zero Trust, IAM and security operations 4 The rest of this folder covers application vulnerabilities.