Security, Privacy & Tenancy
Identity, authorization, encryption, abuse control, privacy law, and tenant isolation.
-
Authentication: Sessions, JWT & OAuth
Sessions vs tokens, JWTs and revocation, refresh token rotation, OAuth 2.0, OIDC, SSO, and mTLS.
-
Authorization: RBAC, ABAC & Policy
RBAC, ABAC, and relationship-based access, policy engines, deny-by-default, and the confused deputy.
-
Encryption, Keys & Secrets
TLS, encryption at rest, envelope encryption and KMS, key rotation, password hashing, and secret storage.
-
DDoS, WAF & Abuse Control
Volumetric vs application-layer attacks, WAFs, bot detection, CAPTCHAs, proof of work, and scraping defense.
-
PII, GDPR, Residency & Audit
Data classification, the right to be forgotten, data residency, retention, anonymization vs pseudonymization, and audit trails.
-
Multi-Tenancy, Isolation & Quotas
Shared, siloed, and bridge tenancy, row-level security, noisy neighbors, per-tenant quotas, and tenant-scoped keys.
Up next
40 of 40 questions here are still unsolved.