Effective Secure Coding

Explore why separating data contexts is fundamental to software defense.
From the IDHS data exposure story to opaque identifiers, PII masking classes, and automated build gates, learn how proper segregation prevents path traversal and data leaks.
All of this, in a beginner-friendly deep dive generated by Gemini's Notebook-LM.

Your database can lie to you. Your frontend definitely can. And AI will happily trust both unless you tell it not to.

This episode explores a core secure-coding rule: treat data as untrusted whenever it crosses a trust boundary - regardless of where it came from.

We look at why validation must happen in context, why the server should reconstruct facts it owns instead of trusting client claims, and how self-validating types can make unsafe states harder to represent.

And with AI generating more application code, these rules matter even more: AI needs explicit boundaries and constraints, not assumptions about what can be trusted.

What happens when perfectly valid data crosses into the wrong place?

This episode explores Habit 1 of the 13 habits from Effective Secure Coding: Think in Trust Boundaries.

Why do secure values become dangerous when they move between users, services, files, APIs, databases, or privilege levels? And what changes when AI is writing the code for you?

We look at how to spot trust boundaries, make them explicit in your design, and give AI coding tools concrete security constraints instead of vague instructions like “make it secure.”

Secure coding starts with one question: where does trust change?