Full Stack to AppSec: Chasing the White Rabbit

The story begins with a side quest.

At the time, I was focused on full stack development. The map seemed large enough already. There were applications to build, frameworks to learn, features to ship, and plenty of terrain left to explore.

Then a rabbit appeared.

Not a literal rabbit, although that would make this easier to explain.

The rabbit appeared while I finally had enough time to wander off the main path and investigate something new. It disappeared into a tunnel beneath the landscape.

The tunnel deposited me in application security.

Or at least that's what I would eventually learn to call it.

At the time, it felt more like a haunted castle. Hidden passages. Locked doors. Strange creatures probing the walls for weaknesses. A boss battle waiting somewhere near the center. Along the journey, every room seemed to contain something useful left behind by a previous traveler. A new skill. A new perspective. Something that solved one problem while quietly revealing three more.

Looking back, the tunnel didn't take me somewhere new. It took me somewhere that had always been there.

From where I was standing, full stack development looked like the landscape. Then the clouds parted.

Beyond them were accessibility, application security, AI, cloud infrastructure, and entire systems quietly supporting the applications I interacted with every day. What started as curiosity about how software worked gradually became curiosity about the parts of the map my training hadn't included.

The more I learned, the less security felt like a separate discipline and the more it felt like studying the foundations beneath the architecture. Vulnerabilities were rarely isolated problems. They were symptoms of larger systems, trust relationships, assumptions, and decisions hiding below the surface.

By the time I reached the center of the castle, every corridor seemed connected.

Defeating the final boss gave me the keys to the castle and a map to find all the trap doors.