One search. Connected ideas.

Protect application boundaries and investigate production failures.

Least privilege limits what a user or service can access, TLS protects data while it travels, and secure headers constrain some browser behaviors. Encryption at rest protects stored data under the storage threat model, but does not prevent an authorized application from exposing it. Security works through several focused controls rather than one universal setting.

Token and session security means accepting only credentials issued by a trusted authority for the intended purpose and lifetime. A JWT can carry verifiable claims, while a server session uses stored state behind a session identifier. Both need secure transport, controlled storage, expiry and a response to credential theft.

Authentication checks the caller's identity, authorization decides whether that identity may perform an action, and RBAC groups permissions into roles. These checks work together but answer different questions. A logged-in employee should not automatically gain access to every employee's records.

Password hashing turns a password into a one-way verification value using an intentionally expensive algorithm. Secret management protects credentials that the application must be able to use again, such as database passwords or API keys. Passwords should not be reversibly encrypted just so they can be compared at login.

XSS, CSRF and CORS concern browser trust but refer to different mechanisms. XSS runs attacker-controlled script in a trusted page, CSRF triggers requests with automatically attached credentials, and CORS controls whether browser code may read cross-origin responses. A defense for one does not automatically solve the others.

Injection occurs when untrusted data becomes part of a command's structure rather than remaining data. SSRF occurs when the server's network access is used to reach an unintended destination. These attacks bypass simple “is this input present?” checks because apparently valid strings or objects can still cause unauthorized behavior.

Rate limiting restricts how much work a caller can request within a defined policy. It protects capacity and makes repeated abuse harder, but it cannot distinguish every attacker or stop all traffic before it reaches the system. Rules should fit the resource, user identity and infrastructure layer.

Big-O describes how an algorithm's work or memory grows as the input grows. Profiling measures where a particular application spends time or retains memory during a real workload. They complement each other: growth rate explains future scaling, while profiling locates the current bottleneck.

API latency is the total time a request spends waiting and doing work across the system. That time can include load-balancer delay, connection-pool wait, application CPU, database work and external calls. Breaking it into stages turns “the API is slow” into a testable explanation.

Pagination, streaming, compression and CDNs reduce different costs of moving data. Pagination returns fewer records, streaming avoids buffering the full payload, compression sends fewer bytes, and a CDN shortens the route for reusable content. Choosing the right technique requires knowing whether the problem is volume, memory, bandwidth or distance.

Observability means understanding a system's behavior from the information it emits. Logs capture events, metrics summarize measurements over time, and traces connect work across a request path. An SLI is a measured service behavior, while an SLO is the target the team aims to meet over a defined period.

Least privilege limits what a user or service can access, TLS protects data while it travels, and secure headers constrain some browser behaviors. Encryption at rest protects stored data under the storage threat model, but does not prevent an authorized application from exposing it. Security works through several focused controls rather than one universal setting.

Token and session security means accepting only credentials issued by a trusted authority for the intended purpose and lifetime. A JWT can carry verifiable claims, while a server session uses stored state behind a session identifier. Both need secure transport, controlled storage, expiry and a response to credential theft.

Authentication checks the caller's identity, authorization decides whether that identity may perform an action, and RBAC groups permissions into roles. These checks work together but answer different questions. A logged-in employee should not automatically gain access to every employee's records.

Password hashing turns a password into a one-way verification value using an intentionally expensive algorithm. Secret management protects credentials that the application must be able to use again, such as database passwords or API keys. Passwords should not be reversibly encrypted just so they can be compared at login.

XSS, CSRF and CORS concern browser trust but refer to different mechanisms. XSS runs attacker-controlled script in a trusted page, CSRF triggers requests with automatically attached credentials, and CORS controls whether browser code may read cross-origin responses. A defense for one does not automatically solve the others.

Injection occurs when untrusted data becomes part of a command's structure rather than remaining data. SSRF occurs when the server's network access is used to reach an unintended destination. These attacks bypass simple “is this input present?” checks because apparently valid strings or objects can still cause unauthorized behavior.

Rate limiting restricts how much work a caller can request within a defined policy. It protects capacity and makes repeated abuse harder, but it cannot distinguish every attacker or stop all traffic before it reaches the system. Rules should fit the resource, user identity and infrastructure layer.

Big-O describes how an algorithm's work or memory grows as the input grows. Profiling measures where a particular application spends time or retains memory during a real workload. They complement each other: growth rate explains future scaling, while profiling locates the current bottleneck.

API latency is the total time a request spends waiting and doing work across the system. That time can include load-balancer delay, connection-pool wait, application CPU, database work and external calls. Breaking it into stages turns “the API is slow” into a testable explanation.

Pagination, streaming, compression and CDNs reduce different costs of moving data. Pagination returns fewer records, streaming avoids buffering the full payload, compression sends fewer bytes, and a CDN shortens the route for reusable content. Choosing the right technique requires knowing whether the problem is volume, memory, bandwidth or distance.

Observability means understanding a system's behavior from the information it emits. Logs capture events, metrics summarize measurements over time, and traces connect work across a request path. An SLI is a measured service behavior, while an SLO is the target the team aims to meet over a defined period.

A jump from 200ms to 5s indicates that requests are doing more work, waiting longer, or both. The first task is to establish scope and timing so the incident is not mistaken for one user's network issue. Then use measured stages to separate a recent regression from traffic or dependency saturation.

Security & performance learning module

Security & performance learning module

Security & performance learning module