Playbooks & production notes
Security, page 3
Security guidance for AI-built apps: authentication, authorization, tenant isolation, secrets, storage, and public endpoints.
Security
Mobile app security best practices for an AI-built product: what changes when there is a native client
Security
The npm audit command, read honestly: what it reports, what to fix first, and how to upgrade without breaking the build
Security
OpenID Connect vs SAML when a customer asks for SSO: what each one does, where OAuth fits, and which one you actually have to build
Security
What OWASP is, and which of its projects a small team actually uses
Security
PCI DSS penetration testing: what Requirement 11.4 actually asks for, how often, and whether it reaches a SaaS on a hosted checkout
Security
Pen test vs vulnerability assessment, red team, bug bounty and audit: how each one is done, and how to tell them apart
Security
The penetration test report format, the agreement you sign first, and what to do with the findings
Security
What a race condition in cyber security is, and the 16 other web vulnerability classes an AI builder leaves behind
Security
Rate limiting in API and web app endpoints: where the limit goes, what numbers to start with, and how to test it
Security
RBAC examples for a small SaaS: the role and permission matrix, written down and proven against the backend
Security
Remote file inclusion, local file inclusion and path traversal: how the bugs happen in a modern app and how to close them
Security
The SaaS security checklist for the product you built, not the SaaS you buy: every control, with the check that proves it
Security
SAST vs DAST, SCA and IAST: which scan proves what, and which ones a small team needs
Security
Secret scanning for a small app: find every key in the repo and its history, then prove the old one is dead
Security
Secrets management best practices for an AI-built app: nine controls, each with a test
Security
SQL injection prevention in an AI-generated app: parameterized queries, the three backstops, and the tests that prove it
Security
Static code analysis tools for an AI-built codebase: what a SAST scan finds, and which to run
Security