Senior Security Engineer | Cloud Security (Azure) · DevSecOps · ISO 27001 · ISO 22301 · ISO 20000 · PCI DSS · SWIFT CSP | Securing Cross-Border Payments
Nigeria
Joined December 2019
- Tweets1.7K
- Following1.5K
- Followers737
- Likes1.3K
Dev habit: use your framework's built-in auth and CSRF protection instead of writing your own. Custom security code needs custom security testing.
10
Careers: learn to write a clear bug report: title, impact, steps, evidence, fix. It is one of the most underrated security skills.
14
Question: which security task do you keep putting off? No judgement. Name it, then book 30 minutes for it.
13
Myth: "We haven't been breached, so we're secure." Fact: breaches can go unnoticed for a long time. No alerts is not the same as no attackers.
12
Code review: look for check-then-act gaps. Checking a balance and debiting it in a separate step lets two fast requests both pass.
2
20
Founder checklist: you have done one practice run of a security incident, even a 30-minute tabletop with the team.
1
21
Cloud: block public storage access at the account level, then allow exceptions on purpose. Defaults should fail closed.
13
Walkthrough: the app trusts the X-Forwarded-For header for the user's IP. Send your own value and the IP rate limit never triggers. Fix: only trust headers set by your own proxy.
1
20
AI agents: separate the agent that reads untrusted content from the agent that takes actions. Put a human or strict rules between them.
1
17
Fintech: give support staff tools that show what they need, not everything. A support screen with full card numbers is a breach waiting for a bad day.
13
API tip: log the user, endpoint and object ID for every sensitive request. When something goes wrong, you need to know whose data was touched.
13
Wednesday fix: review who can approve production deploys. If anyone can, then nobody is really approving.
1
139
Plain words: "encryption at rest" protects stored data if a disk or backup is stolen. It does not protect data from someone logged into your app.
1
62
Midweek nudge: check that the recovery email and phone number on your key accounts are still yours. Old numbers get reassigned.
17
Shipping something before the end of the year? I review web apps, APIs, mobile apps and cloud setups for startups, with plain-English findings and fixes. michaeladeyanju.com
23
OWASP in plain words: Mishandling exceptional conditions. When something fails, the app should fail safely, not fall open, leak details or skip a check.
20