Thirteen Stratagems of Security Brutalism

1. Be Brutal, Not Hostile

Clarity is not cruelty. Interfaces should be sharp, honest, and uncompromising — but never contemptuous. Respect the user by showing them the truth, even when it’s unpleasant.

2. Let Nothing Be Implicit

Assumptions are attack surfaces. Every permission, access, and action must be deliberate. Force the user — and the system — to make their intentions explicit.

3. Make Failure Loud

When things go wrong, they must do so obviously and immediately. Silent failure is a gift to attackers and a betrayal to users. Signal breakage like a fire alarm.

4. Reject Pleasing Messages

Do not design to soothe. A friendly UI that hides real danger is a traitor. Tell the user what’s really happening — even if it’s ugly.

5. Build for the Skeptic, Not the Fool

Assume the user is thoughtful but untrusting. Design systems that inform and empower, not ones that manipulate or oversimplify.

6. Deny by Default

Access should be earned, not assumed. Say “no” until the system has a provable reason to say “yes.” The absence of a rule is not a rule.

7. Friction is a Feature

Speed and smoothness are dangerous illusions. Use friction deliberately — to slow down attackers, to force thought, to demand intention.

8. Design for Forensics

Every important action should leave a trace. Make systems auditable, debuggable, and accountable. Logs are not optional; they are a memory.

9. Expose the Edges

Let users see where the system begins and ends. Interfaces should show seams, not hide them. If it feels safe, it must be safe — not just look it.

10. Trust Nothing Internally

No component, process, or assumption should be exempt from scrutiny. Compartmentalize aggressively. The inside of the system is not a safe zone.

11. Complexity is Betrayal

Unnecessary layers and hidden behaviors breed security flaws. Simplicity is not minimalism — it is ruthlessly eliminating what does not serve defense.

12. Teach Through Consequence

Warnings should be earned through risk, not tossed around idly. Let mistakes sting just enough to educate — not enough to destroy.

13. Never Fake Safety

Don’t reassure. Don’t pad risk with soft language. Tell the user what they’re doing, what it costs, and how it can go wrong — then let them proceed with full knowledge.