About

Security Notes is written by Elias Lankinen. It collects the write-ups that would otherwise stay in internal docs: the controls that hold up in production, the ones that only look like controls, and the reasoning for telling them apart.

More about me, and everything else I work on, lives at lankinen.xyz.

What you will find here

• Web application security, with an emphasis on what browsers enforce for you.
• Threat modelling that a team can finish and act on.
• Build and delivery security, because the pipeline ships the code.

Corrections

If a post gets something wrong, that is worth fixing. Posts carry a published date, and substantive edits update the modified date shown on the article.