Independent practical guidance for handling credentials, authentication, API access, secrets, incidents, and everyday IT security.
Credential security is broader than sending a password safely. Good security also depends on identity verification, least privilege, strong authentication, controlled storage, limited retention, rotation, and incident response.
4 published guides in this topic.
Changing a password does not always end every active session. Understand why session cookies and refresh tokens matter during incident response.
Read articleShared accounts are convenient but weaken accountability, revocation, MFA, and offboarding. Individual identities provide cleaner control.
Read articleA compromised credential can only do what it is allowed to do. Least privilege reduces the impact of mistakes and account compromise.
Read articleTemporary passwords and short-lived tokens reduce the value of leaked credentials and make access easier to control.
Read article