Security Patterns

It walks through JWT vs session auth, shows you how to avoid common mistakes like storing tokens in localStorage or using timing-vulnerable comparisons, and includes working code for RBAC, password hashing with bcrypt, API key authentication, and CORS configuration. The side-by-side "wrong vs correct" examples are genuinely helpful, like pointing out that "invalid password" error messages leak information about which emails exist in your system. Load it when you're building login flows, managing secrets, or need to remember the proper way to set httpOnly cookies. It won't teach you security from scratch, but it's solid for avoiding the footguns.