Zero trust and threat modeling are often presented as frameworks for large organisations. Both are simple ideas for any team: never trust the network, verify every request, and find threats on a whiteboard before production. With a STRIDE threat model of a real file upload feature.
Most DevSecOps advice starts at the pipeline: scanners, gates, signatures. The cheapest security fixes happen earlier, while a feature is still a ticket. How we add security requirements, abuse cases, a lightweight design review and security acceptance criteria to everyday planning without slowing teams down.
Before you can secure a web application you need a list of everything an attacker can touch. A practical method to map inputs, authentication, sessions, file handling, APIs, admin paths and third parties, with the control each area needs.
In a red-team exercise our support agent read a customer-uploaded PDF with hidden instructions and drafted an email with another customer's order details. No data left the building, but the flaw was real. How we contained it with least privilege, confirmation and output checks.
The pre-launch security checklist we run on every new web app, organised by the OWASP Top 10:2025 categories: authorization tests, injection, secrets, headers and CSP, supply chain, error handling and logging, each with a concrete check you can automate.