Cloud security architect at a Dubai fintech, specialising in zero-trust network design on GCP. Designed the IAM framework now adopted as the company's security baseline across all products.
A deep dive into production-grade Firebase Auth pitfalls, focusing on token revocation, custom claims, and identity propagation in zero-trust architectures.
6 August 2026
Fatima Al-Rashid explores the evolution of API security in 2026, advocating for identity-centric, stateless architectures in high-stakes fintech environments.
6 August 2026
Architectural breakdown of managing complex identity fragmentation in Firebase Auth while maintaining strict zero-trust posture across GCP environments.
6 August 2026
Modern identity protocols like OIDC aren't a silver bullet; I explain why session hijacking remains a critical risk in zero-trust GCP architectures.
5 August 2026
An architectural deep-dive into securing cross-origin requests by treating CORS not as a browser feature, but as a critical component of your zero-trust posture.
4 August 2026
Move beyond basic auth to enterprise-grade Firestore security using identity-aware access patterns, VPC-SC, and granular IAM-based data governance.
1 August 2026
Prompt injection is the XSS of AI applications — obvious in hindsight, easy to miss during development, and costly to fix after users have been affected. Here is how it works and how to build applications that are resistant to it.
22 July 2026
This article discusses the implementation of a zero-trust authentication architecture for multi-tenant Flutter applications. It explores threat models, the principles of zero-trust, IAM designs relevant to Google Cloud Platform (GCP), network policies, and auditing strategies to ensure robust protection against unauthorized access.
22 July 2026
Firestore security rules are deployed once and forgotten. The rules written during early development often contain assumptions that no longer hold as the application grows. A systematic audit reveals gaps that have been present — and exploitable — since launch.
21 July 2026
OAuth 2.0 is well-specified but frequently misimplemented. The mistakes that expose user accounts are not obscure — they are common implementation shortcuts that skip required security checks.
21 July 2026
npm projects have hundreds of transitive dependencies from dozens of authors. Each dependency is a potential attack vector. The practices that reduce supply chain risk are not onerous — most can be added to an existing project in a day.
20 July 2026