Backend Security
The four things that get a service breached once the browser-side controls are already in place.
5 topics
Injection & Untrusted Input
Every injection is the same bug — data crossing into a command — and the same fix, which is never building the command by concatenation.
core25 minSSRF & Outbound Requests
Why a URL supplied by a user is a request from inside your network, and the allowlist that is the only reliable defence.
core20 minSecrets & Key Management
Where credentials live, how they get to the process, and what you do in the hour after one leaks.
core20 minPII, Encryption & Data Protection
Knowing which fields are personal data, what encryption actually protects against, and the GDPR obligations that land on the backend.
core25 minSecurity Fundamentals
The handful of ideas — trust boundaries, least privilege, defence in depth — that every specific vulnerability is an instance of.
core25 minshared