Think in threat models
Reason about who your attacker is and what they can reach before writing defences.

The vulnerabilities that actually show up in web applications, how they are exploited, and how to close them for good.
Reason about who your attacker is and what they can reach before writing defences.
Understand and prevent injection, cross-site scripting, and request forgery.
Sessions, password storage, and multi-factor done the way that survives review.
Headers, transport, secrets, and dependencies — the perimeter around your code.
4 modules2h