Cheryl Hung, Vibe Coding Auth Without Melting Down! isaqb Software Architecture Gathering 2025.pdf

1
Vibe Coding
Auth Without
Melting Down!
Cheryl Hung | 25 Nov 2025 | Berlin

C++ engineer
➔ Developer Advocate
➔ Ecosystem Leader
2
Cheryl Hung

4
Vibe code a Javascript
application implementing
on-premise, standards-based
authentication

6
Why authentication?
1. Touches everything
2.
3.
4.

7
Why authentication?
2. Security vs Usability vs Scalability
3.
4.

8
Why authentication?
3. Constantly evolving
4.

9
Why authentication?
3. Constantly evolving
4. Federated identity crosses boundaries

10
🎯 Functionality
⃞ Username and password authentication
⃞ User registration and login
⃞ A protected proﬁle page
⃞ Logout functionality

11
🎯 Requirements
➢ Does not use a SaaS provider
➢ Uses a local user database

✓ Express server with
registration and
login endpoints
13

registration and
login endpoints
✓ Hashes passwords
14

registration and
login endpoints
✓ Hashes passwords
✓ JWT token
generation
15

17
✗ Leaks information about
accounts existing

19
✗ Leaks information about
accounts not existing

21
✗ Checking for duplicate
accounts is not case
sensitive

23
✗ No password requirements

24
✗ OWASP recommends newer
hashing functions

26
What % said security?
What are your challenges when
using/deploying containers?

27
% say
security is
a challenge
when using
containers

28
% say
security is
a challenge
when using
containers

29
% say
security is
a challenge
when using
containers

30
% say
security is
a challenge
when using
containers

31
% say
security is
a challenge
when using
containers

32
% say
security is
a challenge
when using
containers

33
Why is
security so
tricky?!

34
1. Shared responsibility leads to gaps
2.
3.
4.

35
2. Misconﬁguration is the killer
3.
4.

36
3. Identity is the new perimeter
4.

37
3. Identity is the new perimeter
4. Speed vs security tensions

39
“Shift Down”
Kubernetes
Security Paper
Published Feb 2025

40
✨ Application team
● Develop features
● Fix defects

41
✨ Application teams
● Fix defects
● Fix defects
● Fix defects

42
● Fix defects
● Fix defects
● Fix defects
🤖 Platform team
● Self-service /
Automation

43
● Fix defects
● Fix defects
● Fix defects
🤖 Platform team
● Self-service /
Automation
🔒 Security team
● Runtime security
● Compliance
● Vulnerabilities
● Misconﬁgurations
● SW supply chain

44
● Fix defects
● Fix defects
● Fix defects
🤖 Platform team
● Self-service / Automation
● Vulnerabilities
● Supply chain
🔒 Security team
● Compliance
● Vulnerabilities
● SW supply chain

45
● Fix defects
● Fix defects
● Fix defects
🔒 Security team
● Compliance
● Vulnerabilities
● SW supply chain
🤖 Platform team
● Vulnerabilities: Manage base images
● Supply chain

46
● Fix defects
● Fix defects
● Fix defects
🔒 Security team
● Compliance
● Vulnerabilities
● SW supply chain
🤖 Platform team
● Misconﬁgurations: Manage policies
● Supply chain

● Fix defects
● Fix defects
47
● Fix defects
🔒 Security team
● Compliance
● Vulnerabilities
● SW supply chain
🤖 Platform team
● Supply chain: Secure, aest, verify

● Fix defects
● Fix defects
48
● Fix defects
🤖 Platform team
● Supply chain: Secure, aest, verify
🔒 Security team
● Compliance
● Vulnerabilities
● SW supply chain

49
1. Embrace the chaos - platform team
manages common concerns
2.
3.

50
2. Automate trust - Policy as Code
3.

51
2. Automate trust - Policy as Code
3. Less is more - complements Shift Left,
but reduces developer overhead

52
github.com/kubernetes/sig-se
curity/blob/main/sig-security-d
ocs/papers/shift-down/shift-d
own-security.md

Cheryl Hung, Vibe Coding Auth Without Melting Down! isaqb Software Architecture Gathering 2025.pdf

More Related Content

Similar to Cheryl Hung, Vibe Coding Auth Without Melting Down! isaqb Software Architecture Gathering 2025.pdf

More from Cheryl Hung

Recently uploaded

Cheryl Hung, Vibe Coding Auth Without Melting Down! isaqb Software Architecture Gathering 2025.pdf