Backend Security

The checklist every service owes: injection, SSRF, dependency risk, secrets discipline and defence in depth, from the implementer's side rather than the attacker's.

The Backend Security Checklist

The controls every service owes no matter what it does, and the layer each one has to live in.

Q · What does every backend service owe, independent of what it is for?
SQL Injection

Parameterized queries solve injection completely — and do nothing whatsoever for authorization.

Q · How does user input reach a query safely, and what does making it safe still not fix?
Command Injection

The shell is a parser you did not intend to invoke. Pass an argument array, or do not spawn a process at all.

Q · When a backend shells out, what turns a filename into code execution — and what removes the possibility?
SSRF — When the Backend Fetches a URL

A fetch your server makes on a caller's behalf runs from inside your network with your identity. Blocklists lose; egress control holds.

Q · What happens when a user supplies a URL and the backend requests it?
Dependency Security

Most of your running code was written by strangers. The controls are reproducible installs, a known time-to-patch, and a build that does not hand out credentials.

Q · What do you owe for the code you did not write but do ship?
Secrets in Logs

Logging a request object, an auth header or a webhook payload copies a credential into every system your logs reach.

Q · How do credentials end up in log storage, and why is deleting them not the fix?
Defence in Depth

Design as if each control has already failed, and prefer controls that work when someone forgets.

Q · If one control fails, what is left — and is the next layer actually independent of the first?