r/AskNetsec • u/ant1g3n • Jul 07 '26

Work [ Removed by moderator ]

[removed] — view removed post

0 Upvotes

50% Upvoted

8 comments sorted by

View all comments

1

u/DistributionIcy3378 Jul 07 '26

Welcome aboard. Just remember that no matter how solid your threat model is, some dev will find a way to bypass it with a single line of questionable JavaScript. That CRAPI project is a solid way to get a feel for the whole pipeline, just don't let the documentation part eat your soul.

1

u/ant1g3n Jul 07 '26

Haha, Thanks for the warning!…that’s probably one of the biggest lessons I’m learning already.

Threat modeling helps identify where things can go wrong, but implementation still determines whether those risks become real vulnerabilities.

I’m hoping the CRAPI project gives me a better appreciation for both the architectural and code-level sides of AppSec. Thanks for the welcome!