Concepts

Where Learn is imperative — do this, then this — Concepts is explanatory: timeless, diagram-led pages on why the secure defaults are shaped the way they are. Tutorials link into concepts; concepts never require a tutorial.

The section opens with the Traps series: the ten shortcuts every codebase falls into, each titled as the symptom in the words a newcomer would use — "It works if I turn off certificate checking," "Your API key is in the binary" — with one diagram of the failure, one of the fix, and the two-line Easy Button that makes the trap impossible. The real vocabulary (revocation, pinning, attestation) arrives after the problem is solved, never as a prerequisite. Trap #3 is previewed on the homepage.

Alongside the traps sit explainers on certificate chains, revocation, and pinning; on attestation, from measured boot to continuous remote attestation; and on the essential-function doctrine — why communication is the thing being protected, and why a security control that silences your application is itself a denial of service.

Every concept page leads with a diagram drawn in one consistent grammar: ink boxes are your components, hatched zones are attacker positions, and green is the defended path. Learn to read one and you can read them all. The concept pages publish alongside the tutorial ladder as the repositories go public.