Application Security

Auth, sessions, CSP and input validation — the OWASP list treated as a build checklist, not an audit finding.

How I use it

A stolen session token with a long life
Short-lived tokens with rotation and __Host- prefixed cookies, so a captured credential expires quickly and cannot be scoped to a neighbouring subdomain.
A leaked database that is also a password list
Passwords hashed with a memory-hard function and per-user salts. A breach should cost you data, not every account your users have elsewhere.
Framework defaults nobody has read
An explicit content security policy and full header set defined in one reviewable module rather than inherited and assumed adequate.
Input trusted because your own form sends it
Schema validation at every trust boundary. The assumption holds right up until an endpoint is called by something you did not write.

Want the detail behind any of this?

I can walk through any of it in as much depth as you want.