How ISO 27001 certification works for a small SaaS company, how long it takes, and what it costs: audit days set by the standard, platform list prices, the mandatory internal audit, and the three-year cycle nobody budgets. With sources.
A worked STRIDE threat modeling example on a real AWS stack: the filled-in matrix, 29 findings, and the two categories that came back completely empty.
A filtered list of MCP servers worth connecting to a coding assistant, with the specific flag that keeps each one from flooding your context window or writing to production. Plus the cases where a plain CLI beats an MCP server by 20x.
Audit fees, compliance platforms, pentests, and the engineering time nobody budgets. A realistic first-year SOC 2 number for a single-product SaaS team under 50 people, with sources.
Turning on RDS encryption satisfies the compliance question and stops almost none of the attacks that actually leak data. Here is what each layer of encryption at rest really defends against, on Postgres and AWS, and how to build the one that protects the sensitive field.
Environment variables are where secrets go to leak. Here is how to get them out, what each store actually buys you (and costs), and how to wire it into a Spring app without calling an API on every request.
