Security

Threats, mitigations, and defensive design for auth systems.

Webhook Signatures: Verifying What Your Server Is Told
A webhook endpoint is an unauthenticated API that changes your data. How to sign and verify properly — HMAC over the raw body, timestamps and replay windows, constant-time comparison, key rotation, and the idempotency and SSRF issues on both sides.
Aug 3, 20268 min read
Audit Logs for Authentication: What to Record Before You Need It
The events every auth system should log, the schema that makes them queryable, why application logs are not an audit trail, tamper-evidence and retention, and how to expose logs to customers without leaking other tenants' data.
Aug 2, 20268 min read
Stopping Fake Signups Without Punishing Real Users
Why bots register for your product, why CAPTCHA is the wrong first move, and a layered signup defense — honeypots, timing, disposable-domain policy, invisible attestation, progressive trust, and measuring the friction you're adding.
Aug 1, 20268 min read
Credential Stuffing: Why Your Login Page Is Someone Else's Business Model
How stuffing attacks are actually run in 2026 — combo lists, residential proxies, config files and solver services — and the layered defenses that work, from breached-password checks to risk scoring and the metrics that reveal an attack in progress.
Jul 31, 20268 min read
Protecting Auth Endpoints: Rate Limiting and Brute-Force Defense
How to design rate limiting for login, OTP, and reset endpoints — algorithms, what to key on, lockout strategies, and avoiding the traps that let attackers through or lock out real users.
Jun 12, 20268 min read
Common Authentication Vulnerabilities and How to Prevent Them
Credential stuffing, broken session handling, JWT confusion attacks, account enumeration, and the other ways login systems get broken in production — plus the concrete fixes for each.
May 28, 20266 min read

Explore other topics