Four security decisions that look like nothing and are not

1. When implementing a login rate limit, it is crucial to count against the real TCP connection address instead of the X-Forwarded-For header. This prevents attackers from bypassing the limit by setting different values in the header for each request. While it may result in the rate limit being applied to the proxy as a whole rather than per client, the absence of protection is worse than being ineffective, as it gives a false sense of security.

2. To prevent Server-Side Request Forgery (SSRF), it is essential to validate target addresses when registering them. Internal network scanners with a web interface can be created by registering malicious targets like 169.254.169.254 (cloud metadata endpoint) or loopback addresses. By validating target hosts on creation and update, services that accept user-supplied addresses and connect to them, such as webhook configurations or PDF renderers, can be secured from this common bug.

3. Storing SSH host keys on first use and rejecting changed keys later is a crucial security measure. This practice, known as trust-on-first-use (TOFU) raised to an organizational level, helps detect silent man-in-the-middle (MITM) attacks. While TOFU does not catch the first connection, where the attacker may already be in position, it significantly enhances security. However, the only definitive solution is out-of-band host-key distribution, which is rarely implemented.

4. Storing credentials securely by making the console write-only is essential. Users should be able to store and replace credentials without being able to retrieve them back. This approach minimizes the risk of exposing sensitive information, as a read path can be exploited by attackers holding admin sessions, finding IDORs, or with broader scoped tokens.

Instead of providing a "reveal" button for convenience, a connectivity test using the credential without returning it can be implemented to satisfy legitimate use cases without compromising security.