Security Engineering Signals
Green flags show risk-based engineering judgment. Red flags reveal false certainty, missing boundaries and controls placed in the wrong layer.
Green flags
Begins with assets and a threat model.
Priorities follow value and reachability.
Distinguishes prevention, detection and recovery.
Prevention eventually fails; silent failure creates dwell time.
Scopes permissions and blast radius.
A small compromise stays small.
Validates assumptions at every trust boundary.
Boundary crossings are where data changes trust or meaning.
Names residual risk and unknowns.
Security is risk management, not certainty.
Red flags
“We use HTTPS, so we are secure.”
TLS protects a link; it does not authorize callers or validate input.
“JWT means there are no session problems.”
Bearer-token theft, validation and revocation still exist.
“The internal network is trusted.”
A compromised internal workload needs its own identity and limits.
“The frontend already checked permission.”
The caller controls the frontend and can call the API directly.
“CORS protects the API from attackers.”
CORS constrains browsers, not direct clients, and is not authentication.
“The LLM can decide whether the user is allowed.”
Probabilistic text generation is not a deterministic authorization decision.