The system design library
Search and filter every curated system design video, article, repository and paper in one place.
26 resources
Security Engineering
How to build systems that stay secure when things go wrong: threat models, protocols, access control and failures. The author publishes the book free online.
BooksAdvancedFree from the authorBy Ross Anderson · University of Cambridge
Active Directory Password Blacklisting at Yelp
Active Directory Password Blacklisting Leeren Chang, Software Engineer Apr 16, 2018 Many enterprise professionals use passwords that are weak and easily compromised. Equipped with this knowledge, as well as the...
Case StudiesIntermediateRead hereBy Yelp engineers · Yelp
Athenz: Fine-Grained, Role-Based Access Control at Yahoo
yahoocs: By Lee Boynton, Henry Avetisyan, Ken Fox, Itsik Figenblat, Mujib Wahab, Gurpreet Kaur, Usha Parsa, and Preeti Somal Today, we are pleased to offer Athenz, an open-source platform for fine-grained access control, to the community…
Case StudiesIntermediateBy Yahoo engineers · Yahoo
AVA: Audit Web Applications at Indeed
Vulnerabilities in your web applications could endanger your systems. Indeed Security developed AVA to automate scanning for common vulnerabilities.
Case StudiesIntermediateRead hereBy Indeed engineers · Indeed
AWS Security Blog
Amazon GuardDuty Extended Threat Detection correlates weak GuardDuty signals into a single, critical-severity attack sequence finding when their composition crosses a threshold of credibility. On May 20, 2026, the service started attachi…
BlogsIntermediateBy Amazon Web Services engineers · Amazon Web Services
Building Secure and Reliable Systems
Designing, implementing and operating systems that are both secure and reliable.
BooksAdvancedFree from the authorBy Google engineers · O'Reilly / Google
Clock Skew when Syncing Password Payloads at Drobbox
How Dropbox Passwords fixed sync errors from clock skew by replacing a two-way timestamp merge with a three-way merge against a base payload.
Case StudiesIntermediateRead hereBy Drobbox engineers · Drobbox
Distributed Security
A real-world engineering write-up from Microsoft on distributed Security.
Case StudiesIntermediateBy Microsoft engineers · Microsoft
Enterprise Key Management at Slack
Over the years, customers have asked us for stricter control over and visibility into their data in Slack, all while maintaining the product’s most essential features, such as link unfurling, mentions, notifications, and search. We talke…
Case StudiesIntermediateRead hereBy Slack engineers · Slack
Google Security Blog
Google's security blog: news and updates on security topics, such as new Android protections.
BlogsIntermediateBy Google engineers · Google
Hardening Kubernetes Infrastructure with Cilium at Palantir
A real-world engineering write-up from Palantir on distributed Security.
Case StudiesIntermediateBy Palantir engineers · Palantir
Improving Web Vulnerability Management through Automation at Lyft
Vulnerability management can be tremendously time consuming. Flyte provides a path to automation that both saves time and is easy to…
Case StudiesIntermediateBy Lyft engineers · Lyft
Introduction to JSON Web Tokens
What a JWT contains and how it is signed and verified.
DocumentationBeginnerBy Auth0 · jwt.io
MDN: Cross-Origin Resource Sharing (CORS)
The clearest reference for how the browser's cross-origin rules and preflight requests work.
DocumentationIntermediateBy MDN contributors · Mozilla
OAuth Audit Toolbox at Indeed
Integrating third party apps with GSuite can be risky. Indeed's OAudit Toolbox allows you to educate your users and improve application security.
Case StudiesIntermediateRead hereBy Indeed engineers · Indeed
OWASP Cheat Sheet Series
Short, practical guides for defending against each class of web vulnerability.
DocumentationIntermediateBy OWASP · OWASP Foundation
OWASP Top 10
The standard awareness list of the most critical web application security risks.
DocumentationBeginnerBy OWASP · OWASP Foundation
RFC 6749: The OAuth 2.0 Authorization Framework
The standard defining OAuth 2.0 roles and flows.
DocumentationAdvancedBy IETF
Scalability and Authentication at Twitch
Curious how Twitch Identity services address scalability and performance challenges related to authentication?
Case StudiesIntermediateRead hereBy Twitch engineers · Twitch
Scalable IAM Architecture to Secure Access to 100 AWS Accounts at Segment
A real-world engineering write-up from Segment on distributed Security.
Case StudiesIntermediateBy Segment engineers · Segment
Scalable User Privacy at Spotify
At Spotify, we have a complex and diverse data processing ecosystem. Our backend infrastructure handles millions of requests per second, which are processed by over a thousand (micro)services. Our batch pipeline environment is equally co…
Case StudiesIntermediateRead hereBy Spotify engineers · Spotify
Secure Infrastructure To Store Bitcoin In The Cloud at Coinbase
A real-world engineering write-up from Coinbase on distributed Security.
Case StudiesIntermediateBy Coinbase engineers · Coinbase
Security Development Lifecycle at Slack
For development teams, process can often be antithetical to speed. Ease of deployment and security tend to have an inverse relationship, with some resentment for the security team occasionally mixed in. You may have seen the following tw…
Case StudiesIntermediateRead hereBy Slack engineers · Slack
Syscall Auditing at Scale at Slack
If you are are an engineer whose organization uses Linux in production, I have two quick questions for you: 1) How many unique outbound TCP connections have your servers made in the past hour? 2) Which processes and users initiated each …
Case StudiesIntermediateRead hereBy Scale at Slack engineers · Scale at Slack