#>who_may
threat models
csp
privacy
Software / Trust
Who May Do What
Security starts with a list: what you are protecting, from whom, and what a mistake would cost. On the web that means trusting input only after checking it, limiting what a page may load with a Content Security Policy, and keeping personal data to what a feature actually needs. Data work adds a duty of its own: a dataset about people can harm them even when no one breaks in.
Security Essentials
The common failures
OWASP's list of the web application risks that keep recurring.
owasp: top tenLimit what loads
A policy header that tells the browser which sources a page may trust.
mdn: CSPWeb security basics
Origins, cookies, and transport, explained from the browser's side.
mdn: web security