The terrain of web security can be read as a chain of defenses that begins at a shoreline battered by the waves of attack. The water's edge is the "foundations of web vulnerabilities": on top of HTTP, learning why injection and XSS arise — their mechanisms and root remedies — is the trailhead of all defense.

Moving inland, you reach the gatehouse of "authentication and authorization." How do you verify identity and delegate privileges over stateless HTTP? Cryptography holds the key, and protocols like OAuth, OIDC, and passkeys give shape to trust.

Deeper still rises the high ground of "defending by design": beyond reactive validation, the philosophy of building structures where vulnerabilities cannot enter, and systematic defense through threat modeling. At the outermost ring stands the watchtower of "offense and assessment" — to defend, you must know how the attacker thinks. The axis running through this field is a consistent stance: defend in depth, from first principles, not by ad hoc patching.