Code Review Best Practices in the AI Era
Code review is the last line of defence before code becomes everyone’s problem…
Tag
#security
45 posts
Security Engineering for Backend Engineers — Threats, Auth, Crypto and Shipping Securely
Most of us learned to build features first and think about security later…
Secure SDLC, Privacy and the DPDP Act
We’ve covered a lot of specific defenses. This final lesson is about the thing…
Cloud and Infrastructure Security
Your application doesn’t run in a vacuum; it runs on infrastructure — servers…
API Security
Modern backends are mostly APIs — JSON over HTTP, consumed by web apps, mobile…
Logging, Detection and Incident Response
Every lesson so far has been about prevention — and prevention is most of the…
Secrets and Key Management
Lesson 6 ended on a crucial point: encryption is only as strong as the key, and…
Cryptography for Engineers
Cryptography scares people, and that fear causes two opposite mistakes: avoiding…
Injection: Data Treated as Code
Injection has been at or near the top of every security risk list for two…
Web Attacks and the Headers That Stop Them
With authentication, authorization, and injection covered, we reach the attacks…
Supply Chain and CI/CD Security
Here’s a fact that reframes how you think about security: the code you wrote is…
Authorization and Access Control
Lesson 2 got the user through the front door — you know who they are. This…
Authentication Done Right
Authentication — proving who someone is — is the front door of your application…
Think Like an Attacker
Every good defender starts by learning to see their own system the way an…
Security, Privacy & Compliance
We finish with the part that’s easy to skip and dangerous to get wrong. A…
Fraud, Security and Compliance for Payment Systems
One Sunday morning, an online grocery company’s monitoring showed something…
Security, Compliance + Capstone
We’ve covered how to choose, size, speed up, cost out, fine-tune, evaluate and…
ConfigMaps and Secrets
A classic mistake: a team bakes the database URL and the API key straight into…
Security, Ops + Capstone
Everything so far gets your app running on Kubernetes. This final lesson is…
AI Agent Development — From First Loop to Production
Every second LinkedIn post today is about AI agents. Most of them show a demo…
Securing AI Agents — Prompt Injection, Least Privilege, and Sandboxing
In security reviews for agents, I now start with one question: “If this agent…
LLM Engineering in Production
Most LLM tutorials stop at “call the API and print the result.” Production doesn…
Authentication — JWT, Sessions, OAuth
Authentication is the gatekeeper of every backend system. Get it wrong, and your…
Authentication — JWT, Sessions, OAuth in Node.js
Authentication Strategies Compared There are three primary authentication…
Prompt Injection — Attacks and Defenses
Prompt injection is the most important security vulnerability in LLM…
Securing Your LLM Application
Traditional web applications have well-understood security models: validate…
AWS Security Best Practices
Security on AWS is not a single service or a checkbox. It is a layered strategy…
IAM — Roles, Policies, Least Privilege
IAM is the gatekeeper of your entire AWS account. Every API call — whether from…
SQL Injection: The Complete Guide to Understanding, Preventing, and Detecting SQLi Attacks
SQL injection has been on the OWASP Top 10 since the list was created in 200…
Software Security in the AI Era: How to Write Secure Code When AI Writes Code Too
In 2025, 72% of professional developers used AI-assisted coding tools daily. By…
Building a Vulnerability Detection System That Developers Actually Use
Here’s a stat that should concern every security team: 73% of developers say…
Cyberark Rest API Certificate based Authentication - Curl Command to Fetch Credentials
Introduction Cyberark kind of tools are a must for security in your…
Log4j Zero-Day Vulnerability Explained (CVE-2021-44228)
Introduction On 9th December 2021, an industry-wide vulnerability was discovered…
Install Private Artifactory Modules Securely in a Python Docker Build
Introduction I was having a private artifactory, and has my custom modules…
Dockerfile for building Python 3.9.2 and Openssl for FIPS
Introduction In previous posts, we saw how to build FIPS enabled Openssl, and…
How to Patch and Build Python 3.9.x for FIPS enabled Openssl
Introduction In this post, we will see Python 3.9.x patch for FIPS enabled…
How to Patch and Build Python 3.7.9 for FIPS enabled Openssl
Introduction In this post, we will see Python 3.7.9 patch for FIPS enabled…
How to build FIPS enabled Openssl in docker
Introduction In this post, we will see how we can build FIPS enabled openssl in…
How to use NPM Rest API to get audit (npm audit) result
Introduction Npm has a tool called: npm audit which reports if your packages or…
How to solve - Apache Ftp Client library is printing password on console
The problem comes while using FTPS. When developer uses login method of this…
Microsoft Azure Just-In-Time access control
According to Microsoft, Therefore, they recently posted about a feature in beta…
Lets Encrypt SSL Error: The client lacks sufficient authorization 403 Forbidden
This is due to our web server are configured to deny accessing this directory…
Lets-Encrypt SSL Certificate Useful Commands
You might need to put sudo before above command. The command will show details…
How to renew SSL certificate from Lets-encrypt when your website is using cloudflare
Explaining issue: response to preflight request doesn't pass access control check
You are developing a nodejs web application having some UI and backend APIs…