Security

A review point for a fast-moving TypeScript authentication framework's controls and trade-offs

A mutable implementation reference for Better Auth's password hashing, secret rotation, sessions, CSRF and redirect defenses, cookies, OAuth state and PKCE, rate limiting, proxy trust, and outbound requests. Use it to assess framework configuration, not as a substitute for OAuth, OIDC, or WebAuthn standards.

Keyless authentication from external CI/CD systems to Google Cloud

A practical guide to exchanging deployment-platform OIDC tokens for short-lived Google Cloud credentials with explicit admission and IAM controls.

Trust, least-privilege, and audit controls for external workloads

Google's security guidance for hardening federated workload trust against spoofing, privilege escalation, weak audit trails, and malicious credential configurations.

A Terraform-backed baseline for enterprise governance and security

Google's reference foundation for consistent resource hierarchy, identity, networking, logging, policy, secrets, keys, and threat detection at enterprise scale.

Current OAuth deployment requirements for redirect flows, tokens, clients, and proxies

The IETF's OAuth 2.0 Security Best Current Practice updates the original framework's threat model and deployment advice. It requires or recommends stricter redirect handling, PKCE, replay defenses, token privilege restriction, secure client authentication, and hardened proxy boundaries while deprecating weaker grants and response modes.

The normative identity layer over OAuth 2.0 and its token-validation contract

OpenID Connect Core defines authentication over OAuth 2.0 using signed ID Tokens and, optionally, UserInfo. It specifies flows, claims, subject identifiers, discovery relationships, and relying-party validation, but its historic implicit and hybrid flows need constraints from current OAuth security guidance.

A practical risk taxonomy for API authorization, business logic, resources, inventory, and dependencies

OWASP's second API Security Top 10 is an awareness and threat-modeling taxonomy, not an implementation standard. Its ten risk families connect object, property, and function authorization with authentication, resource consumption, business-flow abuse, SSRF, configuration, inventory, and third-party API trust.

Shared responsibility, identity, data, platform, logging, and audit foundations

Ten reviewed Google Cloud Tech episodes on shared responsibility, access and data risks, platform and hardware controls, IAM, service accounts, security logging, and audit logs. The 2020–2021 product roles, defaults, interfaces, and procedures are historical context; current Google Cloud documentation remains the authority for implementation.

The stable W3C baseline for origin-bound public-key registration and authentication

The W3C Recommendation defines the browser and relying-party contract for registering and using origin-bound public-key credentials. It is the stable normative baseline for WebAuthn ceremonies, server verification, authenticator data, user presence and verification, attestation, privacy, and security considerations.

Five historical walkthroughs of scanning, detection, data protection, and security posture

Five reviewed 2019 walkthroughs covering Cloud Security Scanner, anomaly detection, Event Threat Detection, data-loss prevention, and Security Health Analytics. Use the collection to understand the detection and posture-management boundaries, not as current guidance for product editions, roles, detectors, interfaces, or remediation steps.