Module 07
Access and Blast Radius
Where every documented vibe-coding catastrophe actually landed.
5 lessons · 5 videos · 5h 23m
- 07.01
Permissions as Sets
Explain the same-origin policy as the boundary a browser enforces, and how cross-site request forgery abuses a request the browser was willing to authorise.
- 07.02
The Trust Boundary
Draw the line between what the client may be trusted with and what it may not, and place your secrets on the right side of it.
- 07.03
Access Control at the Data Layer
Explain how a session establishes who someone is on later requests, and how session hijacking takes that identity over.
- 07.04
Least Privilege and Blast Radius
Enumerate the deliberate exceptions to the same-origin policy - postMessage, CORS and the others - and say how each one widens what an attacker can reach.
- 07.05
Your Agent Has the Keys
Describe what an agent harness is - the loop it runs, the context it is handed, and the limits placed on it - which is the layer where an agent's reach is actually bounded.