Does this code spark joy? Tidying up your code bit by bit.

When tidying it is important to differentiate between structural and behavioral changes. Behavioral change means changing the way the code operates. Changing the return value of a function is an example of a behavioral change. Structural change, on the other hand, does not change how the code...…

Read this article

What is Data Engineering?

Job titles with the word "data" in them are known to be an enigmatic black box. This post explains how the pieces of the data pipeline fit together and how different teams interact with them.…

Read this article

A Practical Guide to Building Secure SSO

Understanding how to build Single Sign On (SSO) using the OAuth 2.0 framework with OpenID Connect may seem like a daunting task. This practical guide will show you how to build a secure SSO system.…

Read this article

Nonce-based Content Security Policy (CSP) in Rails

Introduction During my time at Gusto as a part of the Application Security team, I’ve been exploring ways to improve defense against Cross-Site Scripting (XSS) in modern web applications. At Gusto, we primarily use Ruby on Rails and React.js. Individually each framework comes with some XSS protections out…

Read this article

Layering authorization into a web application

How we introduced granular authorization into our application and API. Illustration by Camellia Neri Last year, my team extended Gusto’s authorization system to give admins granular access to their companies’ accounts. In software security terms, authorization is the concept of what a user can do in a system, while…

Read this article