Revision · Security & Trust Boundaries

This part reframed security from a list of chores into a way of reasoning about who you trust, with what, and what happens when that trust is misplaced. Almost every decision reduces to two ideas — trust boundaries and least privilege — walked from the outside in, then zoomed out to threats.

What this part covered

• Trust boundaries and least privilege — a boundary is any line where data crosses into a place you don’t control, and least privilege keeps the blast radius small; a vulnerability is almost always a boundary you forgot you had.
• Authentication — prove who you are with factors you know, have, or are, stack them as MFA, choose between sessions and tokens, and never store passwords except salted and slow-hashed.
• Authorization — once identity is proven, decide what you may do with ACLs, RBAC, ABAC (and ReBAC under the hood), enforcing least privilege at the right layer rather than scattering checks.
• OAuth & JWT — delegate access without sharing passwords via OAuth2 and OIDC, verify a JWT without a lookup, and weigh the statelessness it buys against the revocation problem it costs.
• Encryption in transit and at rest — protect data on the wire with TLS and on disk at rest, understand the symmetric/asymmetric split, and recognize that key management is the part that actually decides it all.
• Secrets management — never put credentials in code; keep them in vaults, and shrink the blast radius with rotation and short-lived dynamic credentials.
• Threat modeling & abuse prevention — reason systematically with STRIDE, validate untrusted input relentlessly, defend against DoS/DDoS and abuse, and layer defenses so no single breach hands over everything.
• Designed in, not bolted on — trust boundaries are implied by the architecture, so least-privilege and threat-modeling decisions must be made at design time, alongside the data model and the API.

The takeaway

The mental model to keep is not a castle wall but a building of locked doors where every room assumes the hallway is hostile — the difference between perimeter security and defense in depth. A trust-boundary mindset buys failures that are contained and predictable, at the cost of upfront thinking and the discipline to keep boundaries honest as the system grows — a trade that is overwhelmingly worth it, because the alternative isn’t free, just paid later, all at once, by someone else.