The Full Stack CISO: essays on shipping secure software, from a security leader who still writes the code.https://thefullstackciso.com/en-ushttps://thefullstackciso.com/posts/free-tier-trap/https://thefullstackciso.com/posts/free-tier-trap/I added a cache to save money. It nearly took the app down, and the alert looked like an attack. A postmortem on reading the fine print.Sun, 28 Jun 2026 00:00:00 GMTIncidentcloudflarepostmortemcostkvhttps://thefullstackciso.com/posts/captcha-is-free/https://thefullstackciso.com/posts/captcha-is-free/Turnstile is genuinely unlimited and free. The catch isn’t the price — it’s knowing where your bill actually comes from.Sun, 21 Jun 2026 00:00:00 GMTStrategycloudflareturnstilecostbotshttps://thefullstackciso.com/posts/defend-the-wallet/https://thefullstackciso.com/posts/defend-the-wallet/Cost is a security property. Map the surfaces that spend money, then cap every one of them — and prove the cap actually caps.Sun, 14 Jun 2026 00:00:00 GMTLeadershipcostrate-limitingabusehttps://thefullstackciso.com/posts/fixes-i-didnt-ship/https://thefullstackciso.com/posts/fixes-i-didnt-ship/Restraint is a senior skill nobody blogs about. Three hardening ideas that were correct in theory and would have broken production.Sun, 07 Jun 2026 00:00:00 GMTPracticetradeoffsproductionrestrainthttps://thefullstackciso.com/posts/zero-dollar-siem/https://thefullstackciso.com/posts/zero-dollar-siem/You do not need an enterprise logging tier to know when something is off. Three free parts, wired into a daily report and an hourly alarm.Sun, 31 May 2026 00:00:00 GMTEngineeringmonitoringpg_croncloudflareresendhttps://thefullstackciso.com/posts/otp-only-auth/https://thefullstackciso.com/posts/otp-only-auth/A one-time code stops password theft. It does not stop disposable inboxes from farming accounts — each one with a fresh set of cost caps.Sun, 24 May 2026 00:00:00 GMTSupply chainauthotpabusefail-openhttps://thefullstackciso.com/posts/defense-in-depth-nonprofit/https://thefullstackciso.com/posts/defense-in-depth-nonprofit/The full free-tier security map — and the one architectural fact that reorders every priority on it.Sun, 17 May 2026 00:00:00 GMTLeadershiparchitecturedefense-in-depthcloudflaresupabase