Never Trust security for web apps.
Zero assumed trust. We call it Never Trust — because the moment a system trusts a caller it hasn’t verified, it has already lost. This is the model B5 Secure is built on, distilled into principles you can apply on your next endpoint.
New for 2026 — the Never Trust pipeline is extended across five stages with today’s standards: RFC 9421, FIDO2 passkeys, AuthZEN / OpenFGA, an adaptive firewall, and Continuous Access Evaluation. See Security Extensions →
What is Never Trust?
Never Trust is a security model that verifies access to protected resources with zero assumed trust. Every request is checked with all available options — regardless of whether it comes from an unknown or a “trusted” network, or whether a human or a machine is behind it. It is the developer-facing application of the same idea the industry calls zero trust, sharpened for the people who actually write the endpoints.
- The perimeter is gone — remote work and cloud dissolved the “inside.”
- Third-party packages and SaaS multiplied the attack surface.
- Attacks grew in number and sophistication; consumer trust eroded.
- API-first design exposes far more data to untrusted clients.
Six tenets, adapted for developers.
Think like an attacker and defend like a soldier — the attacker needs only one weakness; you must defend the entire fort. These tenets turn that mindset into habits.
1 · Assume breach by default
During design, ask “what if the attacker is the one calling this?” A convenient public endpoint that confirms whether an account exists is also a tool for an attacker to enumerate your customers. Decide with the breach in mind.
Read the whitepaper →2 · Aggressively verify every request
Zero assumed trust means every request earns its access through the full series of checks. No undocumented switches, no internal-only exemptions — attackers find those first. Absence of evidence must always mean absence of access.
Read the whitepaper →3 · Grant least-privilege access
A dashboard that only reads data needs only read permits. If its key leaks, the blast radius is a few GET endpoints — not your whole platform. Scope every credential to the action and the record it serves.
Read the whitepaper →4 · Limit the data you return
APIs tend to return whole records; clients need a fraction. Default to summary responses and require explicit privilege to widen them. Many record-scraping breaches were simply APIs over-returning by default.
Read the whitepaper →5 · Detect through continuous logging
Log and monitor every request. Replay attempts, credential abuse, and phishing call-backs show up in the logs first — and let you respond, notify, and harden while the attack is still in progress.
Read the whitepaper →6 · Secure the whole environment
Pin and hash dependencies, prefer audited packages, lock down inbound and outbound network access, keep secrets encrypted, and never expose build artifacts. Never Trust extends past your code.
Read the whitepaper →A framework, not just a philosophy.
B5 Secure is a .NET security framework designed from the ground up on Never Trust. It bakes these tenets into defaults — every request runs the pipeline, every action needs an explicit permit, every check fails closed — so your team builds secure software without having to remember to.
// Never Trust: deny unless an explicit permit exists
[Protect] // runs the full pipeline
[Permission("contact.update")] // least privilege
[AuthEntity(typeof(Contact))] // data-aware (ADA)
public OpResult Update(UpdateContact req) { ... }