Research the boundary.
Understand the consequence.
Original technical explanations of attack surfaces, access decisions and defensive design. Primary sources, practical review questions and clear limits — written for people building and operating systems.
The research library.
Security / Engineering / Experience design16 technical guides
Why identity is still the weakest link
A practical look at identity risks in modern infrastructure.
Read article
Designing for system resilience
Key principles for building systems that withstand real-world pressure.
Read article
From research to real-world impact
How offensive research leads to stronger, more resilient systems.
Read article
The role of infrastructure in defence
Why infrastructure decisions determine your security posture.
Read articleSecurity testing starts with a boundary you can explain.
Turn permission, assets and testing constraints into a usable assessment plan before any active testing begins.
Read articleAPI object authorization: decide who can act on each record
A valid login does not establish access to every record. Turn object permissions into explicit rules and repeatable tests for your own API.
Read articleSession revocation: make logout an enforced event
Closing a screen and clearing a cookie are different from ending access. Define what revocation means across your session store, browser and dependent workflows.
Read articleDeploying CSP: move from reports to controlled enforcement
Content Security Policy needs an application inventory, a compatible script strategy and a measured rollout. A pasted header is only the beginning.
Read articleA URL input is a network permission decision.
Design server-side fetch features around destination controls, restricted egress and observable failure instead of URL syntax alone.
Read articleA vulnerability report needs a coordination plan.
Prepare clear, minimal evidence and maintain a working communication path from initial report through remediation and publication.
Read articleRetrieved text should not acquire authority.
Design AI-enabled workflows so documents, tool output and other untrusted content cannot decide their own access or actions.
Read articleA deployment workflow is a privileged application.
Review CI/CD identities, third-party steps and secret lifecycles as part of the production trust boundary.
Read articleDesigning security decisions people can understand
Clear permission feedback, meaningful review and accessible recovery turn security controls into decisions people can make deliberately. Interface design supports enforcement; it does not replace it.
Read articleBrowser isolation is not anonymity.
Understand what separate browser environments protect, where their boundaries end, and how to operate them responsibly.
Read articleResilient routing starts with session rules.
Recover from network failures without duplicating work, losing context or hiding uncertain outcomes.
Read articleAutomation needs a clear handoff to people.
Design narrow permissions, meaningful approval points and evidence that makes human review useful.
Read articleWritten for informed decisions.
Each article separates documented technical behavior from our design recommendations. Original sources, explicit assumptions and clear limits help you decide what applies to your workflow.