6 parts
Break a real app, then fix it: SQL injection, XSS, CSRF, broken access control, password storage, security headers, and supply-chain attacks.
A working threat model for web apps: who attacks them, what they're after, and the shape every lesson in this security series follows.
5 min read
Run a real SQL injection against a real in-browser SQLite database, watch every row come back, then fix it the way Linkstash actually does.
6 min read
How cross-site scripting turns a comment box into a way to run JavaScript on someone else's session, demonstrated live, then fixed with proper escaping.
How cross-site request forgery uses a browser's own cookie-sending rules to trigger actions a logged-in user never asked for, and how to actually stop it.
Credential stuffing, brute force, and the timing bug that leaks which emails have accounts, with the real fix from a login endpoint in production.
argon2id versus faster hashes, why a 12-character minimum beats complexity rules, and a real race condition in a signup endpoint under concurrent load.
