Security Diagrams
One picture per security concept, explained for people who did not write the code
23 articlesSecurity concepts that are spatial or sequential, drawn rather than described. Each diagram covers exactly one idea: where the trust boundary sits, who is holding the credential at each hop, which check is missing from a request path. Every page walks through the image step by step and publishes the Mermaid source so you can adapt it to your own stack.
IDOR, Drawn: The Branch That Is Not There (Diagram)
A flowchart of an IDOR bug. The query the AI wrote looks up the row by id and returns it. The condition that would check whose row it is was never written.
The Supabase Request Path and Three RLS States (Diagram)
A diagram of what happens to a browser query at PostgREST depending on whether Row Level Security is on with a policy, on without one, or never enabled at all.
Password Reset: The Identical Answer (Diagram)
A sequence diagram of a password reset, showing why the reply has to look the same whether or not the account exists, and what the session sweep at the end is actually for.
Session Fixation, Drawn (Diagram)
A sequence diagram of session fixation. The attacker gets a session ID from your own app, leaves it in your browser, and your login hands them your account without changing it.
How Prompt Injection Reaches Your Repo (Diagram)
A sequence diagram of prompt injection against a coding agent: text in a package README arrives in the same channel as your instructions, and the agent acts on it.
The JWT Revocation Gap, Timed (Diagram)
A sequence diagram of one logout against two designs. The session app refuses the next request. The JWT app returns 200 OK until the token's own expiry runs out.
The Three On-Ramps to XSS (Diagram)
A diagram of stored, reflected, and DOM-based XSS as three routes to one sink. Two pass through your server. The third never does, which is why server-side sanitizing misses it.
The Presigned Upload Path (Diagram)
A diagram of what a presigned S3 upload actually does: your server signs a URL, the browser sends the file straight to S3, and your backend never holds a single byte.
Stripe Webhooks: The Retry That Charges Twice (Diagram)
A sequence diagram of a Stripe webhook retry, showing that the duplicate event is caused by your own slow reply, and that the event id is the only thing separating it from a real second purchase.
Magic Links: The Out of Band Hop (Diagram)
A sequence diagram of magic link login, showing that the only live copy of the token sits in an inbox you do not control, and what the single-use burn on the way back is actually for.
Refresh Token Rotation and Reuse Detection (Diagram)
A state diagram of refresh token rotation: every refresh burns the token it used, so a burned token coming back is proof somebody copied it.
PKCE: Who Holds the Secret at Each Hop (Diagram)
A sequence diagram of the PKCE login round trip, showing which party holds the verifier and why an intercepted authorization code is worthless without it.
Slopsquatting: The Attacker Registered the Name First (Diagram)
A diagram of slopsquatting's real lesson: the attacker harvested hallucinated package names and registered them weeks before you ever opened your AI coding tool. By the time you install, the trap is already set.
The Session Lifecycle and the JWT Revocation Gap (Diagram)
A state diagram of a login session: a credential goes live, and it can leave that state two ways. A stateless JWT only has one of them.
From git push to the Bill (Diagram)
A diagram of how fast a leaked cloud key gets used: pushed at 4:23, tried at 4:31, spending your money by 4:35, and the billing alert arrives the next morning.
The Guard That Ran Backwards (Diagram)
A diagram of an inverted authentication check: the AI-written guard let anonymous visitors into 18,697 exam records and locked out the students who had accounts.
CORS Is Enforced by the Browser, Not Your Server (Diagram)
A diagram of who actually enforces CORS: your server answers the request either way, and only a browser chooses to hide the response. curl never asks.
SSRF Is a Network Position Problem (Diagram)
A diagram of why SSRF works: your server sits inside a private network and can reach machines the attacker cannot, so a URL they supply becomes their hand on the inside.
Authentication vs Authorization: Where the Checkpoints Are (Diagram)
A flowchart of the two checks a request passes before it reaches a row, and why hiding the admin button in the browser is not one of them.
CSRF: Who Actually Attaches the Cookie (Diagram)
A sequence diagram of a CSRF attack, showing the step everyone misses: the victim's own browser attaches the session cookie, so nothing has to be stolen.
Supabase Keys and the Trust Boundary (Diagram)
A diagram of what your publishable key and secret key can each reach in Supabase, and why only one of them gets checked by Row Level Security.
Where the Trust Boundary Sits in a Vibe-Coded App (Diagram)
A diagram of the single line that decides what an attacker can read in an app built with Lovable, Bolt, v0 or Cursor, and what stays private.
Which API Key Goes Where (Diagram)
A decision tree for telling a browser-safe API key from one that has to stay on your server, starting from the characters the key begins with.