how to make a website hard to hack

Joseph Thacker lists design decisions that make websites significantly harder to hack: session-based authorization instead of object IDs in paths, simple RBAC schemes instead of granular roles, and strict organization-level data segregation.