SA on Security Architecture: Designing Systems That Cannot Be Breached
Security is an architectural property, not a feature. SA’s five-layer security framework, the pre-build security review questions that focus design on the right threats, and three anti-patterns eliminated at design review.
Why SA Treats Security as Architecture, Not a Feature
Security in software systems cannot be added after a system is built and expected to be complete. It is an architectural property designed into the system from the beginning. Systems designed without security architecture can be secured retrospectively — but at a cost orders of magnitude higher than getting it right the first time. SA treats security architecture as a first-class design concern, equal in importance to the data model.
Five Layers of System Security
The Pre-Build Security Review
| Question | Why It Matters | SA’s Approach |
|---|---|---|
| Who are the adversaries? | Knowing who might attack focuses security design | Malicious insiders, credential theft, API abuse, cross-tenant data access |
| What data must be protected? | Prioritise controls on the most sensitive data | PII, financial data, credentials, business-sensitive content |
| What are the attack surfaces? | Every surface must be secured appropriately | Auth endpoints, API endpoints, file uploads, webhook receivers |
| What are the trust boundaries? | Data crossing a boundary needs validation | User input to database, webhook payload to system, file upload to storage |
| What is the incident response plan? | Security includes detection and response, not just prevention | Log access to sensitive data; alert on anomalies; have a breach response plan |
Never Let These Reach Production
Security Only in the UI
Hiding data behind UI conditions without privacy rules means it is accessible via the API. SA enforces security at the data layer first, the business logic layer second, and reflects it in the UI third.
Credentials in the Database
Storing API keys in data type fields visible to users. SA stores all credentials in the API Connector (marked Private), never in user-accessible data fields.
No Tenant Isolation Test
Building a multi-tenant system without verifying tenant data isolation. SA runs a two-browser isolation test before every production deployment, confirmed by checking the Data API as a different tenant’s user.
Work With SA — Simple Automation Solutions
Pakistan’s leading no-code systems architecture practice. We design tech systems before we build them.
