Solo Auth Quest

Tracks

1. 01🎯The Threat Model You're Ignoring

   0/6 lessons

   Why solo devs get pwned, and how to think about it instead

   Most security writing assumes nation-state attackers. Almost all real solo-dev compromises are opportunistic scanners or lost devices. This track resets your threat model to the actual one — then introduces STRIDE in 60 seconds and the 3-minute / 30-second rules that govern every later layer.

   Lesson list (6)

   • 01
     "Who Would Hack Me?" — The Mindset That Gets You Pwned~15 min · threat-model, mindset, opportunistic-attack
   • 02
     The Universe Is Constantly Scanning You~15 min · scanners, obscurity, certificate-transparency
   • 03
     The Real Threat Is Your Phone, Not a Hacker~15 min · lost-device, layered-auth, phone
   • 04
     The Solo Dev's Threat Model — STRIDE in 60 Seconds~15 min · stride, threat-model, checklist
   • 05
     The Cost of Convenience~15 min · security-tradeoffs, 2fa, habits
   • 06
     From 'It Works For Me' To 'It's Locked For Anyone Else'~15 min · posture, defaults, roadmap

   ✓Quiz · 5 questions→

2. 02📖Auth Vocabulary, Cleanly Distinguished

   0/6 lessons

   AuthN vs AuthZ, sessions vs tokens, identifiers vs credentials vs secrets, perimeter vs per-request, CIA, trust boundaries

   Half of all auth bugs come from confusing two terms that get conflated in the same sentence. This track gives you a clean shared vocabulary so the rest of the quest doesn't talk past you — including why sessions beat JWT for solo apps, why bcrypt and not SHA256, and why 'CIA' has a hidden second A you should care about.

   Lesson list (6)

   • 01
     Authentication vs Authorization — Stop Mixing Them Up~15 min · authn, authz, vocabulary
   • 02
     Sessions vs Tokens — What's Actually In That Cookie~15 min · sessions, jwt, cookies
   • 03
     Identifiers vs Credentials vs Secrets~15 min · bcrypt, hashing, secrets
   • 04
     Perimeter vs Per-Request Auth~15 min · middleware, perimeter, defense-in-depth
   • 05
     Confidentiality, Integrity, Availability (CIA Triad)~15 min · cia, tradeoffs, auditability
   • 06
     Trust Boundaries — Where the Threat Model Bites~15 min · trust-boundaries, architecture, zones

   ✓Quiz · 5 questions→

3. 03🌐The 0.0.0.0 Decision

   0/5 lessons

   The single most consequential line in your config — bind addresses, IPv6 twins, UPnP, reverse-proxy traps

   Almost every solo-dev 'I got owned' story starts with the wrong host binding. This track teaches you to read your own listening sockets, see what's actually exposed from outside, and pick a bind address by walking a 30-second flowchart. By the end, '0.0.0.0' will feel like the load-bearing decision it is.

   Lesson list (5)

   • 01
     What 0.0.0.0 vs 127.0.0.1 vs 192.168.x.x Actually Means~15 min · bind, 0.0.0.0, tailscale-ip
   • 02
     Why Tutorials Tell You 0.0.0.0 (and Why They're Wrong For You)~15 min · tutorials, context, bind
   • 03
     How to Actually Tell What's Listening~15 min · lsof, ss, audit
   • 04
     The Gotchas — IPv6, UPnP, and 'Localhost Only' Lies~15 min · ipv6, upnp, reverse-proxy
   • 05
     Decision Framework — Pick the Right Bind in 30 Seconds~15 min · flowchart, tailscale, ollama

   ✓Quiz · 5 questions→

4. 04🛰️Tailscale as First Line — Power and Limits

   0/5 lessons

   Mesh VPN as the perimeter, ACLs to limit blast radius, the lost-device weakness, alternatives

   Tailscale is the closest thing to a free perimeter for solo devs. This track covers what it actually authenticates (devices, not humans), the 60-second setup path, ACLs that shrink blast radius when a phone disappears, and when to reach for Headscale or raw WireGuard instead.

   Lesson list (5)

   • 01
     What Tailscale Actually Is (and Isn't)~15 min · tailscale, wireguard, mesh-vpn
   • 02
     Tailscale Setup — The 60-Second Path~15 min · tailscale, setup, magicdns
   • 03
     ACLs — Restricting What Devices Can Reach What~15 min · acl, tailscale, tags
   • 04
     The Lost-Device Story — Tailscale's Achilles Heel~15 min · lost-device, key-expiry, device-approval
   • 05
     Tailscale Alternatives — When to Pick Something Else~15 min · headscale, wireguard, alternatives

   ✓Quiz · 5 questions→

5. 05🔢The PIN Layer — Real Auth in 100 Lines

   0/6 lessons

   Middleware, SQLite tables, bcrypt, IP-bound sessions, login/logout, the killswitch endpoint

   The center-of-mass of the quest. We build a complete, drop-in PIN authentication layer for any FastAPI / Starlette app — middleware, four SQLite tables, login with bcrypt, IP-bound session cookies, logout, and the Revoke All killswitch — about 100 lines, no external dependencies beyond bcrypt.

   Lesson list (6)

   • 01
     The Architecture in One Picture~15 min · architecture, schema, middleware
   • 02
     The Middleware — Where Every Request Gets Inspected~15 min · middleware, fastapi, starlette
   • 03
     Bcrypt, Local IP Bypass, Session Cookies~15 min · bcrypt, session-cookies, ip-binding
   • 04
     The Login Endpoint — Where Brute Force Begins~15 min · login, form, rate-limit
   • 05
     Logout & Session Lifecycle~15 min · logout, session-lifecycle, killswitch
   • 06
     Putting It All Together — The Full Module~15 min · full-module, drop-in, fastapi

   ✓Quiz · 5 questions→

6. 06🛡️Brute Force Defense

   0/5 lessons

   The math behind 4-digit PINs, lockout cycles, exponential backoff, honeypots, and self-lockout recovery

   Why 4 digits is enough when you stack the right defenses, why per-IP lockout (not per-user), the trade between hard lockout and exponential backoff, and the always-available recovery path so you never permanently lock yourself out.

   Lesson list (5)

   • 01
     The Math — Why 4-Digit PINs Are Defensible~15 min · bcrypt, math, pin-length
   • 02
     The Lockout Cycle — Counter, Threshold, Blacklist~15 min · lockout, state-machine, rate-limit
   • 03
     Beyond Hard Lockout — Backoff, Jitter, Honeypots~15 min · backoff, honeypot, jitter
   • 04
     The Blacklist — Storage, Lift, Audit~15 min · blacklist, auto-lift, admin
   • 05
     The Self-Lockout Recovery — You Lock Yourself Out~15 min · recovery, self-lockout, runbook

   ✓Quiz · 5 questions→

7. 07🚨The Killswitch & Lost-Device Playbook

   0/5 lessons

   The single most valuable button — fast, complete, recoverable, reachable from any device

   Every layer in this quest serves one moment: the day you realize a device is gone. This track makes that moment survivable — the killswitch endpoint, the 10-minute lost-phone playbook, what to pre-stage before you need it, granular killswitches for lesser incidents, and the post-mortem that turns a near-miss into permanent hardening.

   Lesson list (5)

   • 01
     The Killswitch — The Single Most Valuable Button~15 min · killswitch, ui, bookmarks
   • 02
     The Lost-Phone Playbook — First 10 Minutes~15 min · lost-phone, incident-response, drill
   • 03
     Pre-Staging — What to Set Up Before You Need It~15 min · pre-staging, yubikey, 2fa
   • 04
     Granular Killswitches — Beyond Revoke-All~15 min · granular, incident-mode, severity-ladder
   • 05
     After the Incident — Post-Mortem and Hardening~15 min · post-mortem, hardening, runbook

   ✓Quiz · 5 questions→

8. 08📊Admin Dashboard — Make Security Visible

   0/5 lessons

   Status header in 3 numbers, active sessions table, attempts log, audit log

   Authentication systems fail silently. The first sign that something is wrong is rarely an alarm — it's a vague feeling on a Tuesday afternoon. The dashboard turns that feeling into evidence in 30 seconds. Four sections, one HTML page, no JavaScript framework needed.

   Lesson list (5)

   • 01
     Why You Need a Dashboard At All~15 min · dashboard, visibility, wireframe
   • 02
     The Status Header — Three Numbers That Tell You Everything~15 min · status-header, metrics, color
   • 03
     Active Sessions Table — Who Is Logged In Right Now~15 min · sessions-table, ip-annotation, ux
   • 04
     Recent Attempts Log — Spotting Patterns~15 min · attempts-log, logging, patterns
   • 05
     Audit Log — The Tamper-Evident Record~15 min · audit-log, tamper-evident, forensics

   ✓Quiz · 5 questions→

9. 09🤖Don't Trust the LLM in Your Editor

   0/5 lessons

   Why AI assistants leak secrets, the concrete vectors, and the only defense that works

   The most under-appreciated security risk for solo developers in 2026: the AI assistant in your editor is the single biggest secrets-leak surface, and the leak is silent, well-formatted, and looks helpful. This track covers the headline truth, the five concrete leak vectors, the defense (don't let the LLM see the secret), and what to actually do when (not if) a secret leaks.

   Lesson list (5)

   • 01
     The Headline — LLMs Cannot Keep Secrets~15 min · llm-secrets, headline, shape-leak
   • 02
     The Concrete Leak Vectors~15 min · leak-vectors, reasoning-trace, memory-bleed
   • 03
     The Defense — Make Secrets Unreadable, Not 'Private'~15 min · defense, keychain, ignore-files
   • 04
     Living With Coding Agents — Practical Hygiene~15 min · hygiene, gitleaks, pre-commit
   • 05
     What To Do When (Not If) A Secret Leaks To An LLM~15 min · incident-response, rotation, post-mortem

   ✓Quiz · 5 questions→

10. 10⛓️Beyond PIN — When to Add More Layers

    0/5 lessons

    When PIN stops being enough, passkeys, OAuth & magic links, encryption at rest, the stack map

    The PIN layer from Track 5 is the right answer for a startling number of solo apps — but threat models shift. This track teaches you to recognize when PIN is no longer enough, how passkeys / OAuth / magic links solve specific problems, when encryption at rest matters, and how every layer in this quest plugs into a real stack.

    Lesson list (5)

    • 01
      When PIN Stops Being Enough~15 min · triggers, migration, scaling-up
    • 02
      Passkeys — The Real Replacement For Passwords (Mostly)~15 min · passkeys, webauthn, phishing-resistant
    • 03
      OAuth, Magic Links, and Multi-User Onboarding~15 min · oauth, magic-links, allowlist
    • 04
      Encryption at Rest — When Auth Isn't Enough~15 min · encryption-at-rest, fernet, filevault
    • 05
      The Stack Map — Where Everything You Learned Plugs In~15 min · stack-map, defense-in-depth, summary

    ✓Quiz · 5 questions→