Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Threat Modeling an LLM Application: Trust Boundaries and the OWASP LLM Top 10 2026 Map
In an LLM application the model is not a security boundary: the system prompt, the user's message and retrieved documents meet in one token stream, so authorization and validation decisions belong in code. We map Bookstore.Assistant's data flow with its trust boundaries, show a harmless canary review being followed 10/10 times on two local models, and map the OWASP LLM Top 10 2026 and Agentic Top 10 entries onto the parts of the system.
OWASP A06: Insecure Design — Business Logic Flaws, Race Conditions and Rate Limiting
An order endpoint that works correctly line by line refunds money for a negative quantity, accepts a single-use coupon twice and sells the last copy to two people. We separate design flaws from implementation bugs, find the missing requirements with STRIDE and abuse cases, and fix them with a conditional UPDATE, a transaction, .NET 10 validation and rate limiting.