security
Authentication and Authorization
Authentication verifies who you are. Authorization decides what you're allowed to do. This guide explains both, how sessions and tokens work, and why you should use an auth provider instead of building your own.
CI/CD Security and Supply Chain
How to protect your deployment pipeline and the software it produces — keeping secrets safe, scanning dependencies, and understanding where attacks actually happen.
Rate Limiting and Throttling
Rate limiting caps how many requests a client can make in a given window. It protects against abuse, runaway costs from paid APIs, and accidental self-inflicted overload.
Secrets and Config Management
Every app has settings that change between environments and sensitive values that must never leak. This guide explains the difference between config and secrets, where each should live, and how to manage rotation.
Security Best Practices for Vibe Coders
The most common security mistakes when building with AI tools — and how to avoid them. Covers API keys, environment variables, database security, authentication, and frontend vs. backend.
Web Application Security
The most critical web application attack classes — SQL injection, XSS, broken access control, CSRF, and more — explained plainly with concrete defenses for each.