Security Guides for Developers

Security work usually fails in the details: a reused nonce, a hash that was never meant for passwords, a key committed next to the code. These guides walk through the decisions that matter and the failure mode behind each recommendation.

The guides fall into four groups. Hashing treats SHA-256 and SHA-512 as integrity primitives: checksums for a downloaded ISO image, for a CI artefact, for a backup you are about to restore — and why a fast hash is the wrong choice for storing passwords. Password storage compares bcrypt, scrypt and Argon2 on their cost parameters and memory hardness rather than on benchmark speed. Key material covers entropy when generating passwords, PBKDF2 when a key has to come from a passphrase, and HMAC when an API request must stay verifiable.

Authentication gets the failure modes you actually debug: a signature that fails because one header was missing from the canonical string, a token that expires early because the client clock is off, a certificate whose expiry date you need to read from a PEM file. Every guide ends at a tool running in the tab you already have open — hash a file without uploading it, decode a certificate, verify a signature without sending the payload anywhere.