Map your app the way an attacker sees it: assets, entry points, trust boundaries. Use STRIDE to find threats systematically, then rank them so you fix what matters first.

Meet the ten ways web apps actually get broken — injection, broken access control, XSS, SSRF and friends — by breaking and then fixing each one yourself in a safe sandbox.

Understand the moving parts of modern auth — password hashing, sessions vs tokens, OAuth and OIDC, MFA and passkeys — and where authorization checks must live so nobody walks around them.

Keep keys, tokens, and passwords out of code and git history; audit your dependencies; and lock down the CI/CD pipeline that ships your work. The API keys your AI agents hold count too — least privilege for humans and bots alike.

Build the calm-under-fire basics: logs worth reading, alerts worth waking for, a written response playbook, tested backups, and the blameless postmortem that turns a bad day into a better system.