Lenny ZeltserEvery component a product ships becomes something customers must configure, patch, and defend. WordPress illustrates this, with 90-96% of its security issues originating in plugins because its architecture gives every plugin unrestricted access to the entire system. Self-hosted databases need replication, backups, and version upgrades, while container platforms need network policies, image scanning, and cluster maintenance. Each added component expands both operational load and attack surface.
Modern architectures are changing what products require customers to run:
* Cloudflare's EmDash reimagines WordPress as a serverless CMS with no PHP runtime, no customer-managed database, and sandboxed extensions that must declare specific capabilities such as "read:content."
* WireGuard's implementation fits in roughly 4,000 lines of kernel code, small enough for one person to audit.
* Tailscale builds on WireGuard so devices connect without customers running servers, opening ports, or rotating certificates.
The security improvements came from eliminating components rather than layering new controls on top.
For builders, that shifts the question from "what controls should we add?" to "what can we simplify?" A platform service can replace a customer-managed database, a capability declaration can replace unrestricted plugin access, and a safe default can replace an opt-in checkbox. Each removal shrinks both what customers must maintain and what attackers can target.
For my full article, see:
https://zeltser.com/modern-design-security
AppSec Village
Open Security Conference
