Security thinking
Prioritize real risk
Compare likelihood, impact, exposure, and recovery cost so limited security work addresses the most meaningful risks first.
8 minute lesson
Not every possible weakness deserves the same response. We have limited time, so priorities matter.
Estimate how reachable a weakness is, what an attacker gains, how many users are affected, and how hard recovery would be. Record assumptions instead of pretending the score is precise. Fix easy, high-impact exposure first.
A public note export with no ownership check is reachable today and exposes every account. A theoretical local cache leak may have similar impact, but require server access first.
Exact-looking scores can hide weak assumptions. Keep the ranking comparative and record what evidence would make the priority change.
Rank three notes-app risks using reachability, impact, affected users, and recovery cost. Attach one piece of evidence to the top risk, then change one assumption and show whether the order changes.
Lesson completed