Security Engineering
Learn how systems fail at trust boundaries, how attackers turn one capability into another, and how to design prevention, detection and recovery that remain useful in production. Never memorize a vulnerability without tracing the asset, exploit path and blast radius.
What are you trying to protect?
How are credentials, recovery, sessions and privileged actions protected?
The learning loop
Every lesson and lab returns to the same chain. A defense is incomplete until you can name what remains when it fails.
Flagship experiences
Learn → visualize → threat model → attack → defend → break → debug → practice → interview.
Four zoom levels from “authenticated” down to TLS, cookie flags, session lookup, authorization and audit.
Place components, mark data flows and trust boundaries, then surface threats and missing identity decisions.
Run eight safe attack paths, add defenses and see where the path stops—or how far the blast travels.
Add transport, identity, policy, rate, database, network, secret and audit controls.
Learning domains
Assets, threats, trust boundaries, blast radius, least privilege, defense in depth — and why no system is ever called "secure".
System → assets → actors → entry points → trust boundaries → threats → mitigations. STRIDE, attack surface mapping, attack trees, and how to run a security review on a real architecture.
Who are you? Credentials, password storage, credential stuffing, MFA, passkeys — and one login followed all the way from a browser to a database row.
How the server keeps remembering you: session IDs, cookie attributes, hijacking, rotation, revocation, and what JWTs actually buy and cost.
Delegated authorization, the authorization code flow with PKCE, and the identity layer on top — with the "OAuth is not login" distinction taken seriously.
What are you allowed to do? Ownership checks, RBAC, ABAC and policy, broken access control, tenant isolation, and where enforcement must live.
Hashing vs encryption vs encoding, symmetric and asymmetric keys, signatures, TLS as a security boundary, and certificate trust chains.
The browser is an execution environment an attacker can reach. XSS, CSRF, CORS and the origin model that decides what any of them mean.
The same bug in six costumes: data crossing a boundary and being interpreted as instructions — SQL, shell, paths, URLs, serialized objects.
Authentication, object-level authorization, rate limits, replay, webhooks, mass assignment and file uploads — the boundary most systems actually expose.
Database privileges, data classification, encryption at rest versus in transit, and the copies of your data you forgot about: backups, replicas, logs.
Segmentation, firewall rules, egress control, process isolation, privilege separation, sandboxing — and why a container is not a security boundary you can lean on.
Identity → policy → action → resource. Machine identities, short-lived credentials, and the full lifecycle of a secret from creation to revocation.
Your code is a minority of what you ship. Dependencies, lockfiles, provenance, malicious packages, CI/CD permissions and build integrity.
Secure defaults, fail closed, complete mediation, minimal trusted computing base, error handling that does not leak, and audit logs that answer questions.
Prevention fails. Telemetry → detection → alert → investigation → containment → recovery → learning, plus vulnerability management that prioritises exposure over CVSS.
SAST, DAST, dependency and secret scanning, fuzzing, penetration testing — what each finds, what each misses, and the security tests that belong in CI.
Prompt injection, untrusted tool output, over-privileged tools, poisoned retrieval and memory — and the one rule: the model is never the authorization layer.
No fake security certainty
Engineer Atlas never marks an architecture “secure.” It helps you state what is protected, which controls you verified, which attack paths remain, and how you will know when an assumption stops being true.