Cloudinary Media Developer cheat sheet

Resource type, delivery type and public identifiers have different roles.

Keep secrets server-side and use the documented signature procedure.

Incoming, eager and asynchronous processing have distinct lifecycle effects.

Asset deletion and cached delivery require separate review.

Choose fit, fill, crop, pad and limit from the visual requirement.

Automatic gravity is additional behavior, not implicit in every fill crop.

Chain order, layer scope and units change the result.

Validate representative outputs and cache/lifecycle consequences.

Format, quality, dimensions and crop are different decisions.

Responsive selection needs truthful layout and supported client integration.

Versioning and invalidation have distinct cache effects.

Compare visual/functional quality and representative user performance together.

Public IDs and signatures are not universal authorization or expiry mechanisms.

Private originals and derived delivery need actual supported policy review.

Restrict upload/fetch capabilities and treat automated processing as fallible.

Protect secrets, verify callbacks and understand the exact flag/control scope.

Freshness, storage, eviction and validation are different concepts.

Cache keys must preserve meaningful response differences.

Use stage-specific metrics and representative populations.

Optimize actual media quality and transfer/rendering outcomes, not one isolated byte count.

Identification, authentication, authorisation and accounting are four distinct steps.

MFA needs two different factor categories, not two instances of one.

RBAC suits stable job roles; ABAC suits context-dependent, fine-grained rules.

Kerberos uses a KDC with TGT and service tickets for SSO.

Symmetric ciphers handle bulk data; asymmetric ciphers solve key distribution and signatures.

Signing uses a specified signature scheme with the signer’s private key; verification and custody are essential to origin evidence.

ECB leaks patterns; use authenticated modes such as GCM or encrypt-then-MAC.

Asset inventory and configuration baselines underpin every operational control.

Changes need an appropriate authorization path, recovery planning and relevant evidence.

Emergency changes still require retrospective documentation within a defined window.

Monitor log sources for silence, not just for events.

Distinguish historical Revision 2 phases from current NIST incident-response guidance integrated with broader risk management.

Containment precedes eradication in almost every scenario.

Capture volatile evidence (memory, connections) before disk and before power-off.

Distinguish tolerated data loss from tolerated interruption.

A recovery point and restore time must both meet the stated targets.

A same-failure-domain snapshot alone does not cover loss of that domain.

Verify complete restore procedures and actual dependency behavior.