Secure defaults and least privilege

What this lesson covers

• Default to deny and grant explicitly
• Scope credentials to the minimum they need
• Reduce attack surface by removing unused paths

This lesson sits in Thinking About Threats, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.