Cloudflare is a compensating control — it reduces risk, but doesn't eliminate the need for proper configuration. Three things that go wrong regularly: WAF left in monitoring mode instead of blocking, rate limiting rules too loose to stop credential stuffing, origin server IP exposed letting attackers bypass Cloudflare entirely. Teams treat Cloudflare as a security guarantee instead of a security layer. That gap is exactly what A02 (Security Misconfiguration) measures.

SSO solves authentication — confirming identity. But authorization — who can access what — still happens inside each service separately. Every microservice parses the token and makes its own access control decisions. One service might check role claims. Another might not. A third might cache permissions and miss revocations. SSO gives you a verified identity. What each service does with it is where A01 (Broken Access Control) lives.

You don't write cryptographic algorithms — but you make cryptographic decisions every day. Which TLS versions to allow. How to store API keys — plaintext env vars or secrets manager? Whether to enforce certificate pinning. How often to rotate credentials. Each wrong answer is a cryptographic failure under A04 — even with zero lines of crypto code. The "boring crypto" principle says use existing libraries. Correct — but using existing crypto correctly is its own skill.