Summary

Malcolm McDonald, a security engineer with two decades across investment banking, startups, and PayPal, wrote this to cover application security end to end without assuming a security background: the browser's sandboxing and same-origin policy, server-side input validation and defense in depth, and a development process that catches security bugs before release. Heavy on illustration, it walks through concrete attacks, cross-site scripting, CSRF, clickjacking, man-in-the-middle and DNS poisoning, authentication and authorization vulnerabilities, and injection attacks, explaining each from the attacker's side before the defense. It closes on incident response and third-party supply-chain risk, treating security as an ongoing practice rather than a checklist run once before launch.

Target Readers

• Developers with no security background who need a working mental model of browser and server-side threats before their first security review
• Teams that handle input validation ad hoc and want a systematic defense-in-depth process instead
• Engineers who understand common vulnerabilities individually but haven't connected them to a development process that prevents them

Colophon

Publisher

Mynavi Publishing

ISBN

978-4-8399-9030-5

Published

Jan 2026

List price

¥3,828incl. taxMay differ from the actual selling price on Amazon