security — dídac

four endpoints, eight megabytes each, and a stranger with a for loop
go · 10 min

↵ open 02 2026-08-18

never let the client tell you who owns it
go · 13 min

↵ open 03 2026-04-06

multi-tenant isolation is a security boundary, not a query filter
typescript · 11 min

↵ open 04 2025-12-22

your rate limiter trusts x-forwarded-for. mine did too, until it was measured.
go · 12 min

↵ open 05 2024-12-23

owner-scoped rbac: enforcing 'you can only see your own'
go · 11 min