Independent security journal
Look beneath the surface.
Architecture, cloud, identity, and APIs—translated into engineering decisions teams can verify.
API authorization: check permission on every object
A valid token does not prove access to a specific account, document, or project. Here is how to turn object-level authorization into a testable system property.
Latest writing
View the full archive →Stop secrets before they reach Git
Scanning history is useful but late. The better control blocks credentials before publication and treats every detected key as an incident until it is rotated.
OAuth 2.0 without the insecure legacy
Exact redirect URI matching, PKCE for every client, narrow tokens, and refresh-token rotation form a practical modern OAuth baseline.
A presigned URL is a temporary credential
Limit expiry, object key, method, and signer permissions so a convenient upload path does not become a quiet authorization bypass.
Kubernetes Restricted as the default
Pod Security Standards turn container hardening into an enforceable baseline—provided that exceptions stay narrow, owned, and temporary.
Strict CSP: trust code, not a growing domain list
Nonce- and hash-based policies age better than sprawling allowlists. A report-only rollout makes the transition practical.
GraphQL: limit request cost, not only depth
Aliases, batching, and wide lists can make a shallow query expensive. A safer schema budgets resources and authorizes every resolver path.
Webhooks without surprises: signatures, replay, and idempotency
A valid signature proves origin but not uniqueness. A reliable webhook handler expects retries, duplicates, and out-of-order delivery.
Passkeys: phishing-resistant sign-in without a shared secret
Passkeys bind authentication to the real service origin. Account recovery must be designed to preserve that advantage.
An SBOM is useful only when it answers an operational question
A software bill of materials is not a compliance trophy. It becomes valuable when teams can connect components to products, owners, exposure, and remediation.
Business logic needs adversarial stories
Scanners recognize technical patterns. Logic flaws hide in valid-looking actions performed in the wrong order, quantity, or account context.
SSRF is an egress-control problem
URL validation matters, but the strongest SSRF defense assumes parsers disagree and limits what the workload can reach after validation fails.
JWT validation is a contract, not a decode operation
A readable token is not a trusted token. Safe JWT handling fixes the algorithm, issuer, audience, purpose, and key source before accepting claims.
An API inventory must know how to retire things
Discovery without ownership and an end-of-life path creates a catalog of risk, not control over it.
Resource budgets are security controls
Rate limits should protect expensive business operations, not merely count requests at the edge.
Threat modeling before the backlog hardens
A small, early model of assets, trust boundaries, and abuse cases prevents expensive architectural fixes later.
Vulnerability disclosure is a product interface
A clear policy, safe-harbor language, responsive intake, and ownership turn outside reports into an operating security capability.
Security headers are a browser contract
HSTS, CSP, framing policy, and MIME controls should express deliberate browser behavior—not a copied checklist.
Review dependencies at the diff
Dependency review moves security and license decisions to the pull request, before a new package becomes part of the product baseline.
Zero trust is not a new network zone
Protect resources with explicit identity and context. Moving the same implicit trust behind a different gateway does not create zero trust.
About the journal
Security as a system property.
SecEmbed Journal is written by Lsheay Shald. It explores decisions that reduce uncertainty—from object authorization and OAuth to containers, supply chains, and vulnerability disclosure.
Every article is original editorial writing grounded in open standards and first-party technical documentation. Sources and further reading appear at the end of each piece.