Blog
Notes on building secure software.
Real-world breaches, defenses, and the techniques behind B5 Secure — in plain developer language.
The 7 tenets of NIST’s Zero Trust Architecture (ZTA)
A developer-friendly reading of NIST’s seven ZTA tenets and how they map to the code you write.
Your private Git repository might have been exposed by Azure App Service
What the Azure App Service disclosure means and how to check and harden your deployments.
Understand Cross-Site Scripting (XSS) by examples
A hands-on Never Trust Thinking walkthrough of how XSS injections work — with a video demo.
Defending against XSS input injection by examples in ASP.NET
How to sanitize and reject dangerous input across your subsystems, by example.
Critical RCE vulnerability in the popular Log4j Java package
What the Log4Shell vulnerability was, why it mattered, and the environment-security lessons.
533 million Facebook users’ personal data have been leaked
What the scraping leak teaches about APIs that over-return data by default.