retweet

just retweet it

[Anime Universe @animepsto]

The Izanagi and Izanami jutsu

[Mr. Akyeampong @MrAkyeampong]

Unemployed men at 4pm

[Olaléyé Abdullah 🎨 @olaleyeabdol]

Honoured to present my portrait to the incoming Ogun state Governor during the student scholarship award programme. #yayi

[Olaléyé Abdullah 🎨 @olaleyeabdol]

Still one of my favourite things about pencil, blank sheet of paper and look at where it ended up
#commissioned

[retweet @Olaleyemo]

@DavidPattt Abeg who sabi this dj mix

[J.A Olaoye @JA_Olaoye]

Do you freak out about tell me about yourself?

Here is a cool hack.

[The Tech Prophet (Amospikins) @Amospikins]

SQL Injection Hackers Grand Entrance To Your Database

[Fay. @___dontstressme]

“i gotta go back” 😭

[AFRICAMUSTBEFREE!!!!!!! @engrICO2015]

Omo ! No be only me will hear this 👇 I am shocked ..

Guys come and listen 👇👇

[Ghost St Badmus @commando_skiipz]

During threat modelling, we ask four major questions. These questions help the security engineer, developer, solutions architect and even the product owner to really understand the product and its potential threats.

1.What are we building?
2.What can possibly go wrong?
3.What can we do about it?
4.Have we done a good job?

Now let’s answer each question.

- What are we building?
From the quoted diagram, it’s likely a web application with an AI chat interface (maybe AI support or something similar).

- What can possibly go wrong?
This is where most of the work is done.
There’s no one-size-fits-all here; the way person A thinks about a possible scenario will be different from person B.

There are several threat modelling techniques that can help you list what can go wrong. The most popular and battle-tested is STRIDE. It stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.

Now let’s take each letter in STRIDE and draft potential attack scenarios (2 each).

S – Spoofing
1. Attacker steals a session / abuses weak auth and logs in as a user.
2. Attacker calls the AI Model API directly (no mTLS/API key), pretending to be the web app.

T – Tampering
1. Requests/responses between Web App —> AI API —>DB can be modified if there’s no TLS or signing.
2. Compromised admin panel on the shared host edits chat history or user records in the DB.

R – Repudiation
1. User denies sending a prompt because actions aren’t strongly logged with signed audit trails.
2. Admin/dev denies exporting or viewing sensitive chats since access isn’t logged per identity.

I – Information Disclosure
1. Shared hosting leak gives an attacker DB creds / env vars and full user data.
2. Logs store full chats + PII in plaintext, accessible to anyone with log access or via a breach.

D – Denial of Service
1. Bot floods the AI Model API, exhausting DB connections and making the app unusable.
2. Unbounded chat history + logs fill disk and crash the shared host.

E – Elevation of Privilege
1. Bug/RCE in the web app on the shared host lets an attacker reach the DB and AI API with system-level rights.
2. Poor route protection lets normal users hit admin endpoints or debug AI API paths with admin powers.

- What can we do about it?
Now that we’ve identified potential attacks, this is where you tell architects to redesign or you draft security requirements / mitigation controls. For example:

1. Use strong authentication & API authorization (JWT/mTLS/API keys per service).
2. Enable full TLS + request signing and integrity checks between all components.
3. Implement immutable audit logs with user-specific attribution (timestamp + IP + action).
4. Encrypt all sensitive data at rest, redact/mask logs and apply data minimization.
5. Add rate limiting, WAF and resource throttling (timeouts & quotas) to prevent abuse.
6. Apply strict RBAC, least privilege and network segmentation (avoid shared hosting).

- Have we done a good job?
This is where you reflect as a team: review the identified issues using STRIDE and check if your security requirements capture most of the major/likely security issues.

[Rèxy🍒 @rexystev]

Me:Today am going to finish 4 topics
My brain: you and who👀

[The Tech Prophet (Amospikins) @Amospikins]

Why Do Devs Joke with Security???

[itzlilmiles @UTDitzmiles]

Liverpool didn't get a Slot😭😂😂

[MICLOTH @micloth01]

When it’s your Funeral but your family only has one pic of you. 😂

[hinata @HinataMotivates]

Whenever I feel lost, I watch this.

[Tamale @256Rootyherman]

"But where did you learn Golf from yet ure from a poor family?"

[Premier League @premierleague]

“You want me to cry?”

We asked some familiar faces to welcome Eden Hazard to the Premier League Hall of Fame…

[𝓔𝔁𝓬𝓪𝓵𝓲𝓫𝓾𝓻 @deniyi__ishola3]

This guy dey always pami 😂😂😂

[retweet @Olaleyemo]

@_AbdAzheez @Naija_PR I sight you