Application and Infrastructure Security

Security in modern software development is not a separate discipline imposed at the end of the delivery cycle—it’s an engineering constraint woven throughout design, development, deployment, and operations. This collection examines practical security practices that reduce risk without becoming paralyzing bureaucracy.

Foundational Security Practices

Secure Coding and Design begins with understanding common vulnerability categories and threat models relevant to your application. OWASP Top 10, injection attacks, authentication bypass, insecure deserialization, and information disclosure require continuous awareness and proactive mitigation.

Dependency Management and Supply Chain Security address one of the most critical attack vectors: compromised libraries and transitive dependencies. Practices include automated vulnerability scanning, dependency updates, license compliance, and integrity verification.

Secrets and Credential Management prevents the catastrophic mistake of embedding keys, passwords, and tokens in source code. Modern approaches use secret managers, identity providers, and ephemeral credentials that eliminate long-lived secrets entirely.

Infrastructure and Network Security protect systems through defense-in-depth: least-privilege network access, encryption in transit and at rest, identity-based authentication, and zero-trust principles applied to infrastructure access.

DevSecOps Integration

Articles in this section explore security practices that integrate smoothly into CI/CD pipelines, infrastructure-as-code workflows, and container ecosystems. Topics include automated scanning, policy-as-code for security rules, secure deployment pipelines, observability for security signals, and incident response automation.

The goal is security that enables shipping, not security that becomes the bottleneck. Effective security practices shift left into development, integrate into automation, and reduce manual security reviews to the decisions that actually matter.

Who Ran That Migration?

Three hours into a production incident, someone asks the obvious question. Silence. The terminal closed, the build log expired last week, and your migration tool printed “Success” before forgetting everything. This scenario repeats constantly: privileged CLI operations that modify production systems, then vanish without a trace. The fix requires discipline, not genius: structured logging, user identity tracking, and persistent storage.

"We Store Secrets in appsettings.json": A Horror Story in Five Acts

Every Azure subscription I’ve worked with has the same problem: connection strings with embedded credentials in appsettings.json, Service Principal secrets checked into Git history, storage account keys hardcoded everywhere. The credential sprawl is real. These aren’t careless developers. These are smart people applying on-premises patterns where they don’t belong. Azure Managed Identity flips the model entirely. Instead of your application proving identity by presenting a secret, Azure proves identity on your application’s behalf through cryptographic attestation. No secrets in code. No credentials in configuration. No rotation ceremonies. The Azure SDK’s DefaultAzureCredential handles authentication automatically, working identically in local development and production. Combined with RBAC, you scope permissions to exactly what each application needs. Not Contributor-level access to the entire subscription. Just the specific operations on specific resources that the application actually requires. This article walks through credential anti-patterns I encounter constantly, then shows the correct implementation using Bicep and .NET’s DefaultAzureCredential. The migration path is pragmatic: within weeks, not months, you can have zero static credentials in your codebase.

247 Strangers Have Root Access to Your Production

Your organization has a thorough vendor approval process. Procurement forms. Security questionnaires. Legal reviews lasting months. Then your developers run npm install and pull 247 packages from strangers on the internet—and nobody blinks. That’s the supply chain security paradox most teams live with daily. This guide shows you how to implement Dependabot, dependency review, and SBOM generation as the defensive controls they should be—not as checkbox compliance theater.

Stop Deploying Garbage to Production

I’ve watched “senior engineers” deploy code with failing tests because “we need to ship.” I’ve seen secrets hardcoded in workflows, vulnerabilities ignored with || true, and production deployments without a single approval gate.

Then the same teams act surprised when they get breached. Or fail an audit. Or both.

Security gates aren’t process overhead—they’re the bare minimum that separates professional engineering from reckless gambling with customer data. Here’s exactly how to build GitHub Actions pipelines that actually protect your systems.

Your Azure SQL Backups Won't Save You (Here's Why)

“We have backups” is the IT equivalent of “thoughts and prayers.” Comforting words that mean nothing when disaster strikes. I’ve watched teams discover their Azure SQL Database backups expired just before an audit, or worse, during an actual outage. The default seven-day retention feels generous until you need data from day eight.

Compliance standards demand information backup in cloud environments, but no standard can enforce what most teams ignore: actually testing those backups. The gap between “we configured backups” and “we can restore our data” has ended careers and companies. This isn’t about checking compliance boxes. It’s about whether your business survives the next outage.