Security recipes
Attacks, and what stands in their way.
Every recipe takes one real attack class and walks the whole engagement: how the attack works, the concrete Sentinel mechanism that counters it — with the code and the tests that pin the behavior — and the part of the defense that stays your responsibility. No hand-waving, no "enterprise-grade security" adjectives.
- 01
Session fixation
ThreatPlant a known session identifier before the victim logs in, then reuse it after authentication elevates it.CounterSessions and tokens are minted server-side only after credential verification; nothing presented pre-authentication survives into the authenticated state. - 02
Token theft & reuse detection
ThreatExfiltrate a refresh token (XSS, malware, logs, backups) and quietly mint access tokens for its whole lifetime.CounterEvery refresh rotates atomically; presenting a rotated token revokes the entire family and emits token.refresh_reuse_detected. - 03
SAML signature wrapping
ThreatInject a forged assertion into a validly-signed SAML message so the signature verifies against one element while the SP consumes another.CounterPinned-certificate verification plus a reference-equality check that the signed element IS the consumed element, with algorithm/transform allowlists and XXE prohibition before any trust decision. - 04
User enumeration
ThreatProbe authentication endpoints to learn which email addresses have accounts, building a target list for stuffing, phishing and password spraying.CounterUniform error codes, dummy-hash timing equalization on unknown users, always-succeeding reset requests, and enumeration-safe 404s on owned resources. - 05
Credential stuffing
ThreatReplay breached credential pairs at scale, distributed across IPs and paced to slide under naive rate limits.CounterFour independent abuse layers (per-IP, per-IP+account, account lockout, distinct-identifier stuffing heuristic) with adaptive CAPTCHA, risk-engine step-up, and per-layer configurable failure modes.