Security, Auth, and Compliance
Auth, compliance, OWASP, and the security work that enterprise buyers will ask about on day one.
46 posts · page 1 of 2
- Security, Auth, and Compliance
Tenant Aware Authorization: The Mistake That Leaks Data
Missing tenant context in authorization checks is the most common data leakage pattern in multi-tenant SaaS. Here is how it happens and how to prevent it.
7 min read
- Security, Auth, and Compliance
SQL Injection in 2026: Still Happening, Still Preventable
SQL injection has been on the OWASP Top 10 for two decades. It is still being exploited. Here is why and how to stop it.
7 min read
- Security, Auth, and Compliance
SOC 2 Type I vs Type II: A Founder's Guide to Both
SOC 2 Type I proves you have the controls. Type II proves they work over time. Here is what each means and when you need them.
7 min read
- Security, Auth, and Compliance
Single Sign On for Enterprise SaaS: SAML and OIDC Compared
SSO is a procurement requirement for enterprise deals. Here is what SAML and OIDC each mean for your engineering roadmap.
8 min read
- Security, Auth, and Compliance
Session Management for Web Apps: A Modern Take
Sessions are the foundation of authenticated web applications. JWT vs cookies, refresh token rotation, session invalidation: here is how modern session management works and what each choice costs.
6 min read
- Security, Auth, and Compliance
Server Side Request Forgery: The Quiet Killer in SaaS Integrations
SSRF lets attackers make your server request internal resources they cannot access themselves. SaaS products that fetch external URLs are especially vulnerable. Here is how it works and how to prevent it.
6 min read
- Security, Auth, and Compliance
Secrets Management for SaaS: Vault, AWS Secrets Manager, Doppler
Environment variables in .env files work until they do not. At scale, secrets management needs audit trails, rotation, and least-privilege access. Here is how Vault, AWS Secrets Manager, and Doppler compare and which to choose.
6 min read
- Security, Auth, and Compliance
SCIM Provisioning: The Feature Enterprise Customers Will Demand
Enterprise customers expect user accounts to sync automatically with their identity provider. SCIM makes this possible. Here is what SCIM is, what implementing it actually involves, and when to build it versus buy it.
6 min read
- Security, Auth, and Compliance
Right to Be Forgotten: How to Implement It Without Pain
GDPR's right to erasure requires deleting personal data on request. Most implementations create more pain than necessary because they conflate logical deletion, audit trail requirements, and referential integrity. Here is how to separate them cleanly.
6 min read
- Security, Auth, and Compliance
Personally Identifiable Information in Logs: A Cleanup Playbook
Most SaaS applications log more PII than they should. Here is how to audit what personal data is in your logs, which fields to remove or redact, and how to prevent future PII from entering the logging pipeline.
6 min read
- Security, Auth, and Compliance
Penetration Testing for Startups: Cost, Scope, and Cadence
Penetration testing is required by enterprise buyers, security certifications, and good judgment. Here is what a real penetration test includes, what it costs for a startup, when to commission one, and how to extract maximum value from the findings.
6 min read
- Security, Auth, and Compliance
PCI DSS for SaaS Touching Payments: Patterns to Avoid the Trap
PCI DSS compliance is required for any product that processes, transmits, or stores cardholder data. Here is how to reduce your compliance scope to the minimum and which architecture patterns avoid the most expensive compliance requirements.
6 min read
- Security, Auth, and Compliance
Passkeys for SaaS: The Migration Plan
Passkeys are the successor to passwords and are now supported across all major platforms. Here is what passkeys actually are, how they work technically, and how to migrate an existing SaaS application without breaking current users.
6 min read
- Security, Auth, and Compliance
OWASP Top Ten for SaaS in 2026
The OWASP Top Ten is the standard list of critical web application security risks. Here is what each risk means in practice for a SaaS product, which ones are still commonly exploited in 2026, and how to address each without over-engineering the fix.
6 min read
- Security, Auth, and Compliance
Multi Factor Authentication: WebAuthn, TOTP, and Beyond
MFA is no longer optional for B2B SaaS. Here is how TOTP, WebAuthn, passkeys, and hardware keys compare, what to implement first, and how to enforce MFA without alienating your user base.
6 min read
- Security, Auth, and Compliance
Logging Customer Data: The Privacy Mistakes That Get You Sued
Application logs are where GDPR violations happen silently. Here is what data should never appear in logs, how to audit existing logging, and the patterns that keep you compliant without losing operational visibility.
6 min read
- Security, Auth, and Compliance
JWT Best Practices in 2026: What Has Changed
JWT implementation mistakes from 2019 are still shipping in 2026. Here is what the current best practices actually are, what has changed with algorithm recommendations, and the common pitfalls that create security vulnerabilities.
6 min read
- Security, Auth, and Compliance
ISO 27001 for Engineering Founders: A Practical Reading
ISO 27001 looks like a compliance bureaucracy but reads like an operational checklist for running a secure organization. Here is what engineering founders actually need to understand before starting the certification process.
6 min read
- Security, Auth, and Compliance
Insecure Direct Object References: The Bug Founders Underestimate
IDOR vulnerabilities let attackers access other users' data by changing an ID in a URL or API request. They are simple to introduce and expensive to miss. Here is how to find and prevent them.
6 min read
- Security, Auth, and Compliance
Incident Response for Startups: A Playbook
A startup does not need an enterprise incident response program. It needs a simple, documented process that prevents the chaos that happens when something breaks at 2am and nobody knows who does what.
6 min read
- Security, Auth, and Compliance
How to Sell to Enterprise Without a Full Compliance Stack
You do not need SOC 2 Type II and HIPAA certification before your first enterprise conversation. Here is what you actually need and how to close the deals while you build toward the rest.
6 min read
- Security, Auth, and Compliance
HIPAA Compliance for Health SaaS: The Real Engineering Lift
HIPAA compliance for health SaaS is the engineering work that determines whether you can sell to healthcare customers. The work is real but bounded. Here is what the engineering lift actually looks like.
13 min read
- Security, Auth, and Compliance
GDPR for SaaS Builders: What You Must Have on Day One
GDPR is not optional for any SaaS that touches EU users. The minimum is small and concrete. The teams that build it in from day one save quarters of retrofit work.
12 min read
- Security, Auth, and Compliance
Encryption at Rest vs in Transit: What Customers Will Ask
Encryption at rest and in transit are the two questions enterprise customers ask first. Both are easy to get right. The teams that have not thought about either stumble on the easiest part of a security review.
11 min read
More than blog posts.
The Labs folder has the experiments themselves. The Systems folder has the stack and architecture. The Journey folder has the timeline. Pick whichever pulls you.