Application Security
Shift left, guard the runtime
Secure development in cloud means threat modeling, secure design review, static and dynamic analysis, software composition analysis, secrets management, dependency scanning, and infrastructure-as-code scanning inside the pipeline. In cloud, the API is the application: inventory APIs, authenticate and authorize every call, validate input, rate-limit, and log. Classic risks persist, but cloud adds broken object-level authorization in APIs, application roles that are far broader than the code needs, and secrets committed to repositories or baked into environment variables.
Multi-tenancy in your own application
If you build SaaS, tenant isolation depends on your code: tenant identifiers enforced in every query, per-tenant keys, and shared caches or search indexes that do not leak across boundaries. This is the same pooled-resource problem the provider solves for you, one layer up.
Responsibility by model
In IaaS you harden OS and application. In PaaS you own code plus the configuration of the managed runtime: connection strings, feature flags, identity settings. In SaaS you own configuration, meaning sharing settings, SSO configuration, integrations, and the OAuth scopes you grant to third parties.
Traps
- A web application firewall mitigates but does not fix vulnerable code.
- Managed platform patching does not fix your dependency vulnerabilities.
- A secret committed to a repository is compromised even if the repository is later made private.
- Third-party OAuth consent can expose data with no exploitation at all.
Rule of thumb
Threat-model every trust boundary the application crosses: the user to the API, the API to cloud services, and your application to third-party SaaS.