Blog
Articles on application and infrastructure security — secure pipelines, authentication, and practical security engineering.
30 articles
Credential design for tool-using AI agents: keep secrets out of the context window, use domain_secrets in sandboxes, audience-bound per-request MCP tokens, one scoped identity per tool, and approval gates on writes.
Read More
Attack your own tool-using agent before someone else does: wrap it as a promptfoo target with recorder tools, scan for indirect prompt injection and data leaks, and turn every finding into a CI regression test.
Read More
Three environments, one small team, and a value that must never reach a build log. When a secret is read decides everything that follows.
Read More
Most compliance checklists were written for databases. None of them has a row for an outbound HTTPS request carrying a customer's words to a model provider in another country.
Read More
An agent is neither a user nor a service account. What RFC 8693, two IETF drafts and Entra Agent ID each say about who authorised an agent's action.
Read More
A plugin bundle can carry hooks that fire without a prompt, MCP servers that open egress, and skill prose that lands in the agent's instructions. Here is the pre-install audit.
Read More
Claude Code accepts seven kinds of credential and picks one by a fixed precedence order. Here is that order, where each is stored, and CI tokens.
Read More
Claude Code picks the first managed source that delivers a policy key and ignores the rest — it does not merge them. That one rule explains most policy that silently fails.
Read More
Read-only by default, an asymmetric directory boundary, and an accept-edits list that quietly includes rm. Here is what actually gates an agentic session.
Read More
ZDR is not a switch in your admin settings, and it is not free. Five features are disabled at the backend, one model class becomes unavailable, and one gap is yours to close.
Read More
Auto mode replaces permission prompts with a classifier that blocks anything irreversible or aimed outside your environment. Here is how to teach it yours.
Read More
How Claude Code sandboxing isolates the agent's bash commands with filesystem and network limits, and how that cuts the lethal trifecta behind prompt injection.
Read More
Permission prompts break under prompt injection. A sandbox does not. How confining the filesystem and network neutralizes the lethal trifecta and unlocks real autonomy.
Read More
How Claude Code permission modes trade approval prompts for autonomy, what plan, default, acceptEdits, and bypassPermissions each do, and how to match a mode to a task.
Read More
How untrusted text an AI coding agent reads can smuggle in commands, why filtering it out fails, and the containment strategy that actually reduces the risk.
Read More
A field checklist for hardening MCP servers: token audience validation, SSRF and session defenses, stdio and HTTP transport risks, and supply-chain threats.
Read More
OAuth 2.1 folds a decade of security fixes into one spec: PKCE for everyone, no implicit or password grants, and stricter rules for tokens and redirects.
Read More
How I lock down XSS in Next.js with a per-request nonce, strict-dynamic, and a safe Report-Only rollout.
Read More
Why RBAC breaks in multi-tenant SaaS and how OpenFGA, the Zanzibar-inspired ReBAC engine, models permissions as relationship tuples checked at the resource level.
Read More
How I reach my homelab and VPS from anywhere with zero inbound ports open — cloudflared config, ingress rules, and Zero Trust access policies.
Read More
How eBPF runs sandboxed programs inside the Linux kernel without modules, and how Tetragon turns that into process, network, and file visibility on Kubernetes.
Read More
A real IDOR in a multi-branch ERP: how a detail endpoint that fetched by id alone leaked another branch's revenue, and the branchId-scoping fix I rolled across every Prisma module.
Read More
How to verify NIK/KTP identity against Dukcapil through authorized providers, add face-match and liveness, and handle sensitive data under UU PDP.
Read More
How I lock down Linux daemons from the outside using systemd's built-in sandbox — filesystem, temp, privileges, and syscalls — then measure the result.
Read More