Forem: Kira Zenith

🔐 From 0 Production-Grade Security

Kira Zenith — Wed, 08 Apr 2026 19:53:47 +0000

“If it works on localhost, hackers say thank you.”

Let’s go from completely insecure → production-ready security in simple steps.

0. The Reality Check

Every app is vulnerable by default
Security is NOT a feature → it’s a layered system
Goal: make hacking too expensive & annoying

1. Basic Hygiene (Don’t Be an Easy Target)

Use HTTPS only (no excuses)

// Express.js
app.use((req, res, next) => {
  if (req.protocol === 'http') {
    return res.redirect(`https://${req.headers.host}${req.url}`);
  }
  next();
});

Store passwords with hashing (bcrypt / argon2)

import bcrypt from "bcrypt";

const hashed = await bcrypt.hash(password, 10);

Never store secrets in code → use env variables

// ❌ BAD
const DB_PASSWORD = "mysecret";

// ✅ GOOD
const DB_PASSWORD = process.env.DB_PASSWORD;

Validate ALL inputs (frontend ≠ security)

import Joi from "joi";

const schema = Joi.object({
  email: Joi.string().email().required(),
  password: Joi.string().min(6).required()
});

👉 At this stage, you block “script kiddies”

2. Authentication Done Right

Use JWT / Session-based auth

import jwt from "jsonwebtoken";

const token = jwt.sign({ userId: user.id }, process.env.JWT_SECRET, {
  expiresIn: "1h"
});

Add password rules (length > complexity)
Implement rate limiting (login brute force = blocked)

import rateLimit from "express-rate-limit";

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100
});

app.use("/login", limiter);

Add email verification

👉 Without this, your app = open gate

3. Authorization (Most Devs Mess This Up)

Authentication = Who are you
Authorization = What can you do

Use Role-Based Access Control (RBAC)

function authorize(role) {
  return (req, res, next) => {
    if (req.user.role !== role) {
      return res.status(403).send("Forbidden");
    }
    next();
  };
}

// Usage
app.delete("/admin", authorize("admin"), handler);

NEVER trust frontend roles
Check permissions on backend EVERY time

Example:

Just because UI hides “Delete” doesn’t mean API should allow it

4. Protect Against Common Attacks

💥 SQL Injection

Use prepared statements / ORM
Never concatenate queries

// ❌ BAD
db.query(`SELECT * FROM users WHERE email = '${email}'`);

// ✅ GOOD
db.query("SELECT * FROM users WHERE email = ?", [email]);

💥 XSS (Cross-Site Scripting)

Escape user input
Use Content Security Policy (CSP)

import xss from "xss";

const safeInput = xss(userInput);

💥 CSRF

Use CSRF tokens
SameSite cookies

👉 These 3 alone stop most real-world attacks

import csrf from "csurf";

app.use(csrf());

5. Secure Your APIs

Add API rate limiting
Use API keys / OAuth

if (req.headers["x-api-key"] !== process.env.API_KEY) {
  return res.status(401).send("Unauthorized");
}

Validate request schema (never trust input)

if (!req.body.email) {
  return res.status(400).send("Invalid request");
}

6. Data Protection

Encrypt sensitive data at rest

import crypto from "crypto";

const encrypted = crypto.createCipher("aes-256-cbc", key)
  .update(data, "utf8", "hex");

Use secure cookies: HttpOnly, Secure, SameSite

res.cookie("token", token, {
  httpOnly: true,
  secure: true,
  sameSite: "strict"
});

Don’t expose internal IDs (use UUIDs)

7. Infrastructure Security

Use firewall (WAF)
Enable logging + monitoring

import morgan from "morgan";

app.use(morgan("combined"));

Auto-block suspicious IPs
Keep dependencies updated (very important)

8. Advanced Layer (Production-Level)

Add 2FA (Two-Factor Authentication)

const otp = Math.floor(100000 + Math.random() * 900000);

Implement Zero Trust mindset
Use security headers: HSTS, X-Frame-Options, X-Content-Type-Options

import { v4 as uuidv4 } from "uuid";

const userId = uuidv4();

9. Test Like a Hacker

Run vulnerability scans
Do basic penetration testing
Use tools like: Burp Suite, OWASP ZAP

10. Assume Breach (Final Boss Level)

“It’s not if, it’s when.”

Log everything important
Set up alerts
Have a rollback plan
Backup regularly

console.error("Unauthorized access attempt", req.ip);

🧩 Final Mental Model

Security = Layers

Input → Auth → Authorization → Validation → Monitoring → Response

Break one layer → others still protect you.

“Perfect security doesn’t exist. But lazy security gets hacked first.”

You’ll Never Forget OOPS Relationships Again

Kira Zenith — Fri, 03 Apr 2026 20:42:53 +0000

Every strong system you build starts with strong fundamentals.

Most people read these concepts. Few actually remember them in interviews.

Here’s the simplest way to lock them in forever 👇

1. Association — “Just knowing each other”

Two objects are related, but can exist independently.

Example:
A Teacher and a Student

A teacher teaches students
Both can exist without each other

Memory trick:
People in the same WhatsApp group

2. Aggregation — “Has-a (loose ownership)”

One object contains another, but they can still live separately.

Example:
A Team has Players

If the team is deleted, players still exist

Memory trick:
Company hires employees (they can resign)

3. Composition — “Has-a (strong ownership)”

One object completely owns another. If parent dies, child dies.

Example:
A House has Rooms

Destroy the house → rooms are gone

Memory trick:
Human body → organs

4. Inheritance — “Is-a relationship”

One class inherits properties/behavior from another.

Example:
A Dog is an Animal

Dog gets all common animal traits

Memory trick:
Child inherits traits from parents

Quick Sheet

Association → uses
Aggregation → has (weak)
Composition → has (strong)
Inheritance → is

Interview Hack

Can child exist without parent? → YES → Aggregation → NO → Composition
Is it “is-a”? → YES → Inheritance
Otherwise? → Association

And About Cracking Big Companies...

Interviews don’t test memory, they test clarity — this is your edge. So Today it’s OOP relationships — tomorrow it’s cracking your dream job 🚀

Crack LLD in 1 Month (Even With a Full-Time Job)

Kira Zenith — Thu, 02 Apr 2026 14:39:21 +0000

Somehow… nothing gets finished.

The Problem

If you're working + preparing to switch:

You start learning patterns
You get overwhelmed
You stop halfway

Repeat.

The Shift

One simple realization will change things:

Someday you have to change your life, why not today?

The Rule

1 pattern. 20–30 minutes. Every day. Revise.

No excuses. No overplanning.

My Method (Super Simple)

For every pattern, I only focus on this:

Problem → why does it exist?
Normal way → how would I solve it without pattern?
Pattern → Solution?
UML → quick structure
Use case → where is it used?
Edge cases → where can it fail?

That’s it.

Reality Check

You don't need 5 hours daily or 1 perfect resources

You need:

A plan
Good notes
Daily revision

Resources for LLD

And About Cracking Big Companies..

Following this will surely make you confident in system design interviews.
Because after all, who is stopping you from cracking Google? Maybe you.