Guides
Website and AI security guides
Practical advice you can act on today — no jargon required.
1–8 of 20 guides
SaaS tenant isolation: keeping each customer’s data separate
Practical checks for SaaS teams: tenant boundaries, exports, search and background jobs, using two test organisations.
7 November 2026 · 4 min read
Security review for AI-built websites and apps
What to review before launching an AI-generated application: permissions, secrets, storage, dependencies and production settings.
7 November 2026 · 4 min read
API security: broken object-level authorisation explained
Why a valid login must not grant access to every record, and how to assess API permissions safely with test accounts.
7 November 2026 · 4 min read
RAG chatbot security: who can see your documents?
Protect document-search chatbots with permission-aware retrieval, tenant isolation and checks for revoked access.
7 November 2026 · 4 min read
AI agent security: when to require human approval
Reduce risky agent actions with least privilege, meaningful confirmations and independent checks before tools run.
7 November 2026 · 4 min read
Login, sessions and MFA: an application security checklist
Review sign-in and recovery together: session expiry, logout, privileged actions and safe MFA changes.
7 November 2026 · 4 min read
Secure file uploads in web applications
A practical upload review covering allowed types, size limits, private storage, previews and download permissions.
7 November 2026 · 4 min read
Webhook security: signatures, replays and duplicate events
How to protect payment and integration webhooks, verify event senders and avoid processing the same event twice.
7 November 2026 · 4 min read