Application Security

Auth, sessions, CSP and input validation — the OWASP list treated as a build checklist, not an audit finding.

How I use it

Session and token design
Short-lived tokens with rotation and __Host- prefixed cookies, so a captured credential expires quickly and cannot be scoped to a neighbouring subdomain.
Credential storage
Passwords hashed with a memory-hard function and per-user salts. A breach should cost you data, not every account your users hold elsewhere.
Content security policy and headers
An explicit policy and full header set defined in one reviewable module rather than inherited from a framework default and assumed adequate.
Input validation
Schema validation at every trust boundary. The assumption that your own form is the only caller holds until an endpoint is called by something you did not write.

Want the detail behind any of this?

I can walk through any of it in as much depth as you want.