Security & Compliance Guides

Explore common security threats and discover how to apply best practices and compliance standards to keep your app and users safe.

A developer's guide to GDPR compliance

GDRP affects companies the world over and as a developer, it's your job to ensure compliance. Read our guide to the basics to understand what GDPR entails.

Security policy document examples for B2B SaaS apps

If you’ve been put in charge of writing a security policy document, you might feel a tad overwhelmed. This guide will help, with examples from companies like Slack and Stripe.

How to get SOC 2 compliance: A developer’s guide

Learn how to get SOC 2 compliance and how long it takes.

A developer’s guide to startup security

The size of your startup, no matter how small, won’t keep it safe. In this post, we cover five common threats facing your startup and explain how they work.

Key differences between CCPA and GDPR: How location affects enterprise compliance

Discover the key compliance differences between CCPA and GDPR and how each law affects your business operations.

SOC 1 vs. SOC 2 vs. SOC 3: Why your company needs compliance to grow

Compliance stands between your company and growth. If you want to sign enterprise deals, learn the differences between SOC 1, SOC 2, and SOC 3, and how best you can comply.

Understanding CSRF attacks

What is a CSRF attack? Learn how these attacks exploit user trust in web apps and how you can prevent them.

The developer's guide to domain verification

Learn what domain verification is, how it works, its challenges, best practices, and how you can use WorkOS to verify domains.

OTP bots explained: What they are and how to stop them

Learn how OTP bots work, their role in bypassing MFA, and the top methods to protect your accounts from these cyber threats.

Understanding cross-site scripting (XSS) attacks

XSS attacks are not to be taken lightly. Learn what XSS is, the different types of attacks, and how you can defend against them.

Best practices for secrets management

This guide explains best practices for keeping your secrets where they belong—secured away from public code and prying eyes.

What is device fingerprinting and how does it work?

Your device leaves a unique trail of digital breadcrumbs whenever you open a web browser. These aren't cookies that you can delete – they're subtle signals from your hardware and software that combine to create something far more permanent: your device fingerprint.

What is CMMC 2.0 and who needs it?

A plain-language guide to the Department of Defense's cybersecurity certification program, who it applies to, and what compliance actually looks like at each level.

What is ISO compliance?

A practical guide to ISO 27001 for software companies: what the standard requires, how certification works, and why it matters for enterprise sales.

What is a SIM swapping attack?

A practical guide to SIM swap attacks: how attackers hijack phone numbers, why SMS-based MFA falls short, and what developers can do to protect users.