Tokenization vs Encryption for Card Data
Every few months a product manager or a board member asks me some version of the same question: "We encrypt the card numbers, so we are PCI compliant and safe,...
11 min441Read →
Tagged #security
8 articles tagged #security.
Designing for Audit Trails from Day One
Every fintech founder I have worked with eventually has the same uncomfortable conversation with an auditor, a regulator, or a partner bank's risk team. The...
11 min975Read →
Understanding Webhook Signatures
Almost every fintech integration I have shipped eventually grows a webhook surface. Card networks, payment processors, KYC vendors, ledger systems, and...
10 min431Read →
Building a Fraud Detection Pipeline
Fraud detection is one of those problems that looks deceptively simple from the outside. Someone makes a payment, you decide whether it is legitimate, and you...
10 min723Read →
An Engineer's Introduction to PCI DSS
Every engineer who touches a payments system eventually runs into PCI DSS, usually at the worst possible moment: a few weeks before a deadline, when someone in...
11 min368Read →
Managing Secrets in .NET Applications
Every breach post-mortem I have read in the last decade has a secrets problem buried somewhere in it. A connection string in a config file checked into source...
11 min529Read →
Rate Limiting Strategies for Payment APIs
Every payment platform I have helped build eventually runs into the same uncomfortable truth: the request you cannot afford to drop and the request you must...
11 min873Read →
Securing Fintech APIs: A .NET Developer's Checklist
Security in a fintech API is not a feature you bolt on at the end, just before launch, when someone in compliance asks the uncomfortable question. It is a set...
4 min556Read →