{
  "id": 19565584,
  "title": "Security Is an Architectural Decision, Not a Finishing Touch",
  "url": "https://urgent.news/2026/11/11/security-is-an-architectural-decision-not-a-finishing-touch",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-11T22:59:40.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/phenzic/security-is-an-architectural-decision-not-a-finishing-touch-166n"
  },
  "original_language": "en",
  "account": "Securing APIs has become a critical engineering responsibility as the developer productivity tool Shiplogue has transitioned from a local IDE extension to a cloud-based service. Shiplogue captures commits, coding-agent activity, and reviews, then compiles them into daily standups that developers can review and share across various platforms like VS Code, Cursor, and Antigravity.\n\nTo ensure the security of its cloud infrastructure, project-based access, and integrations, the developers at Shiplogue have implemented OAuth 2.0 and JSON Web Tokens (JWT) for authorization and token validation. The tutorial on securing REST APIs using OAuth 2.0 and JWT is particularly valuable for understanding the distinction between authentication and authorization. OAuth 2.0 handles delegated authorization, while JWT serves as a token format that carries verifiable claims.\n\nThe tutorial emphasizes that OAuth 2.0 and JWT are not competing technologies; instead, they complement each other in a comprehensive security model. JWTs carry claims that can be validated to confirm the identity of the user, the intended audience, and the permissions associated with the token. Protecting API endpoints, managing scopes, roles, and custom permissions, and validating token signatures are all crucial aspects of securing Shiplogue's cloud infrastructure.\n\nAs Shiplogue has grown beyond a local IDE extension into a cloud-backed service, the developers have had to make various architectural decisions to ensure data minimisation, project-level isolation, and access control. They utilize OS-level keychains for storing credentials and hash connector keys at rest, ensuring that only sanitized activity metadata and diff summaries are synced to the cloud when enabled. Dashboard access is restricted to authenticated workspace members, and the developers continuously evaluate security considerations as the product evolves.",
  "summary": "I've been thinking about this a lot while building Shiplogue , especially as I've worked on its cloud infrastructure, project-based access, and integrations. Recently, I came across a JetBrains tutorial titled Secure Your APIs: OAuth2 and JWT for Beginners , and I thought it was worth sharing. What the tutorial covers The tutorial walks through securing REST APIs using OAuth 2.0 and JSON Web…",
  "key_points": [
    "Shiplogue secures cloud infrastructure with OAuth 2.0 and JWT.",
    "Developers implement OAuth 2.0 for delegated authorization and JWT for token validation.",
    "Architectural decisions prioritize data minimisation and access control."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}