Playbooks & production notes
Security, page 2
Security guidance for AI-built apps: authentication, authorization, tenant isolation, secrets, storage, and public endpoints.
Security
API authentication best practices: keys, tokens, mTLS, and what to use between services, cloud identities and agents
Security
API key leaked what to do now: the first hour, in order, and how to be sure the old key is dead
Security
API keys exposed on frontend code: which keys can live in the browser, which must never leave the server, and how to check your bundle
Security
Audit logging best practices for a SaaS: what to record for role changes, deletions and billing changes
Security
Authentication best practices for the six flows that hold: signup, login, logout, password reset, email verification, and OAuth callbacks
Security
The authentication checklist for an AI-built app: who can reach what, and how you prove it
Security
How to cap monthly usage on a metered API: keep the key server-side, set a ceiling, and hear about it before the invoice does
Security
Cloud application security assessment for a small SaaS: what the provider secures, what is yours, and what CASA is
Security
Content security policy unsafe inline: how to remove it without breaking the app, add HSTS and framing protection, and check the headers you actually send
Security
"The developer owns our hosting account": how to move every provider into accounts you own, and the inventory that proves it
Security
The environment variables security risk nobody lists: one set of keys for development, staging and production
Security
Examples of security questions: the standard list, why they are a weak recovery factor, and what to use instead
Security
File upload testing: the limits to set, the bucket to lock, and the 8 tests that prove a stranger cannot read a file
Security
How to rotate API keys safely: the overlap, the dependents list, and the rollback
Security
How to test OWASP Top 10 vulnerabilities on a small web app: one test per category and the evidence to record
Security
Implement two factor authentication for owner and admin accounts: in the app, on every provider dashboard, and how to prove it is enforced
Security
The input validation web app builders skip: a schema on every write endpoint, and the malformed payloads that prove it
Security