# Pemikiran & Cerita: Security

> Berbagi pengalaman, pembelajaran, dan petualangan saya di dunia teknologi dan lainnya.

URL: https://www.matthewswong.com/id/blog/category/security/

- [Patch Gap Project Glasswing: 6.157 Diungkap, 516 Di-patch](https://www.matthewswong.com/id/blog/project-glasswing-patching-deficit-open-source/)
- [Kewajiban Pelaporan Cyber Resilience Act: Runbook DevOps](https://www.matthewswong.com/id/blog/eu-cra-reporting-september-2026-devops-runbook/)
- [NIST AI Agent Standards Initiative: Cakupan CAISI](https://www.matthewswong.com/id/blog/nist-ai-agent-standards-initiative-caisi/)
- [Studi AIBOM Hugging Face: 97,940 Model, Dokumentasi Kosong](https://www.matthewswong.com/id/blog/aibom-completeness-hugging-face-models-ml-bom/)
- [Pickle Model Scanner Evasion: ShadowPickle dan Safetensors](https://www.matthewswong.com/id/blog/shadowpickle-model-scanner-evasion-safetensors/)
- [PP 33/2026 Pelindungan Data Pribadi: Panduan Developer](https://www.matthewswong.com/id/blog/gr-33-2026-pdp-implementing-regulation-developers/)
- [Agent Skill Berbahaya: Panduan Supply Chain SKILL.md ClawHavoc](https://www.matthewswong.com/id/blog/agent-skills-supply-chain-clawhavoc-skill-md/)
- [GitGuardian Secrets Sprawl 2026: AI Agent Commits, MCP Configs](https://www.matthewswong.com/id/blog/gitguardian-secrets-sprawl-2026-ai-agent-commits/)
- [Laporan Ancaman Anthropic September 2026: Pelajaran DevOps](https://www.matthewswong.com/id/blog/anthropic-threat-report-september-2026-agent-attacks/)
- [Laporan Keamanan Kode AI 2026: Veracode Mentok di Pass Rate 56%](https://www.matthewswong.com/id/blog/veracode-2026-genai-code-security-report-pass-rate/)
- [Cursor CVE-2026-22708 RCE: Built-in Shell Lolos dari Allowlist](https://www.matthewswong.com/id/blog/cursor-cve-2026-22708-shell-builtins-allowlist-bypass/)
- [Sesi AI Coding Assistant yang Dibajak Menyebarkan Worm Shai-Hulud](https://www.matthewswong.com/id/blog/hijacked-ai-coding-assistant-session-shai-hulud-100-repos/)
- [Worm npm dengan Provenance SLSA Valid: Pelajaran keyv](https://www.matthewswong.com/id/blog/npm-valid-slsa-provenance-malicious-keyv-worm/)
- [EU AI Act Digital Omnibus Deadlines: A DevOps Team Calendar](https://www.matthewswong.com/id/blog/eu-ai-act-digital-omnibus-devops-deadlines/)
- [Kompromi npm Tensorlake Shai-Hulud: Kunci Install Script](https://www.matthewswong.com/id/blog/tensorlake-npm-shai-hulud-ai-sdk-worm/)
- [Slopsquatting 2026: Rate Halusinasi Package dan 127 Nama](https://www.matthewswong.com/id/blog/slopsquatting-2026-frontier-models-package-hallucination/)
- [Deadbugz MCP Server: Pertahanan Poisoning Metadata Tool Saat Runtime](https://www.matthewswong.com/id/blog/deadbugz-mcp-runtime-metadata-poisoning/)
- [Splunk MCP Server CVE-2026-76404: Patch Triage untuk App MCP](https://www.matthewswong.com/id/blog/splunk-mcp-server-cve-2026-76404-ai-toolkit-advisory/)
- [GitLost: GitHub Agentic Workflows Prompt Injection Defence](https://www.matthewswong.com/id/blog/gitlost-github-agentic-workflows-prompt-injection/)
- [Kerentanan Secrets GitHub Actions di Claude Code dan Gemini CLI](https://www.matthewswong.com/id/blog/claude-code-gemini-cli-codex-ci-secrets-github-issue/)
- [Bypass runAsNonRoot containerd: Fix dan Audit CVE-2026-46680](https://www.matthewswong.com/id/blog/containerd-cve-2026-46680-runasnonroot-bypass/)
- [Perubahan Keamanan Kubernetes 1.36: userns, kubelet, gitRepo](https://www.matthewswong.com/id/blog/kubernetes-1-36-user-namespaces-kubelet-authz-gitrepo-removed/)
- [Kubernetes Manifest-Based Admission Control Beta di 1.37](https://www.matthewswong.com/id/blog/kubernetes-manifest-based-admission-control-beta/)
- [Sentry MCP Prompt Injection: Panduan Bertahan dari Agentjacking](https://www.matthewswong.com/id/blog/sentry-mcp-agentjacking-prompt-injection-incident-agents/)
- [Pulumi Neo Security: Read-Only Scans, Fixes Only as a PR](https://www.matthewswong.com/id/blog/pulumi-neo-security-read-only-assessment-proposed-diff/)
- [Sandbox AI Coding Agent: Atasi Approval Fatigue di CI](https://www.matthewswong.com/id/blog/anthropic-how-we-contain-claude-sandbox-approval-fatigue/)
- [Enterprise MCP Reference Architecture dengan Cloudflare Portals](https://www.matthewswong.com/id/blog/cloudflare-enterprise-mcp-reference-architecture-portals/)
- [MCP Write Controls: Cloudflare WriteGuard vs Approval Prompt](https://www.matthewswong.com/id/blog/cloudflare-writeguard-mcp-write-controls/)
- [Deteksi Shadow MCP dengan Policy Cloudflare Gateway](https://www.matthewswong.com/id/blog/cloudflare-shadow-mcp-detection-gateway-policy/)
- [GitHub Agentic Workflows Study: The Prompt Injection Gap](https://www.matthewswong.com/id/blog/gh-aw-empirical-study-prompt-injection-gap/)
- [Insiden Keamanan Hugging Face 2026: Dataset adalah Kode](https://www.matthewswong.com/id/blog/hugging-face-july-2026-incident-dataset-pipeline-lessons/)
- [Transformers trust_remote_code Vulnerability: CVE-2026-4372](https://www.matthewswong.com/id/blog/transformers-cve-2026-4372-trust-remote-code-bypass/)
- [LiteLLM CVE-2026-42208: Fix SQL Injection dan Hardening Gateway](https://www.matthewswong.com/id/blog/litellm-cve-2026-42208-sql-injection-hardening/)
- [Serangan Supply Chain LiteLLM: Dependency Cooldown PyPI](https://www.matthewswong.com/id/blog/litellm-pypi-supply-chain-attack-dependency-cooldowns/)
- [OpenSSF Model Signing: Sign dan Verify Model ML dengan OMS](https://www.matthewswong.com/id/blog/openssf-model-signing-oms-sign-verify-ml-models/)
- [Least Privilege AI Agent: Credential, Token, dan Secret](https://www.matthewswong.com/id/blog/ai-agent-least-privilege-credentials/)
- [Red Teaming AI Agent dengan Promptfoo: Panduan Praktis](https://www.matthewswong.com/id/blog/red-teaming-ai-agents-promptfoo/)
- [Identitas AI Agent: Delegated Authorization Setelah OAuth 2.1](https://www.matthewswong.com/id/blog/ai-agent-identity-delegated-authorization/)
- [Secret Environment PaaS: Build-Time vs Runtime Injection](https://www.matthewswong.com/id/blog/paas-environment-secrets-management-teams/)
- [Checklist Kepatuhan UU PDP untuk Fitur AI di Indonesia](https://www.matthewswong.com/id/blog/uu-pdp-ai-feature-compliance-checklist/)
- [Keamanan Plugin Claude Code: Audit Sebelum Install](https://www.matthewswong.com/id/blog/claude-code-plugin-supply-chain-security/)
- [Autentikasi Claude Code: Semua Metode Login Dijelaskan](https://www.matthewswong.com/id/blog/claude-code-authentication-login-methods/)
- [Managed Settings Claude Code: Kebijakan yang Benar-Benar Mengikat](https://www.matthewswong.com/id/blog/claude-code-managed-settings-enterprise-policy/)
- [Model Keamanan Claude Code: Lapisan, Kepercayaan, dan Batas](https://www.matthewswong.com/id/blog/claude-code-security-model-layers/)
- [Zero Data Retention Claude Code: Apa yang Anda Korbankan](https://www.matthewswong.com/id/blog/claude-code-zero-data-retention-compliance/)
- [Claude Code Auto Mode: Menyetel Permission Classifier](https://www.matthewswong.com/id/blog/claude-code-auto-mode-permission-classifier/)
- [Permission Modes Claude Code: Otonomi vs Keamanan](https://www.matthewswong.com/id/blog/claude-code-permission-modes-guide/)
- [Sandboxing Claude Code: Menjalankan Bash dengan Aman](https://www.matthewswong.com/id/blog/claude-code-sandboxing-bash-guide/)
- [Checklist Keamanan MCP Server untuk Developer](https://www.matthewswong.com/id/blog/mcp-server-security-checklist/)
- [Serangan Prompt Injection pada Coding Agent AI](https://www.matthewswong.com/id/blog/prompt-injection-ai-coding-agents/)
- [Sandboxing Agen AI dan Lethal Trifecta](https://www.matthewswong.com/id/blog/sandboxing-ai-agents-lethal-trifecta/)
- [OAuth 2.1 vs OAuth 2.0: Apa yang Berubah dan Cara Migrasi](https://www.matthewswong.com/id/blog/oauth-2-1-vs-2-0-migration/)
- [Content Security Policy di Next.js: Nonce & strict-dynamic](https://www.matthewswong.com/id/blog/content-security-policy-nextjs-nonce/)
- [OpenFGA ReBAC: Otorisasi Multi-Tenant Fine-Grained](https://www.matthewswong.com/id/blog/openfga-rebac-multi-tenant-authorization/)
- [Membangun e-KYC untuk Fintech Indonesia: Verifikasi NIK/Dukcapil yang Benar](https://www.matthewswong.com/id/blog/nik-ktp-dukcapil-verification-api-indonesia/)
- [Ekspos Layanan Self-Hosted dengan Aman via Cloudflare Tunnel](https://www.matthewswong.com/id/blog/cloudflare-tunnel-zero-trust-homelab/)
- [Observability eBPF dengan Cilium Tetragon di Kubernetes](https://www.matthewswong.com/id/blog/ebpf-observability-cilium-tetragon/)
- [Mengeraskan Service Linux dengan Sandboxing systemd](https://www.matthewswong.com/id/blog/systemd-hardening-sandboxing-services/)
- [IDOR yang Membuat Satu Cabang Membaca Pendapatan Cabang Lain](https://www.matthewswong.com/id/blog/branchid-scoping-idor-multi-branch-erp/)
- [Passkey di Next.js: Autentikasi Tanpa Kata Sandi dengan WebAuthn](https://www.matthewswong.com/id/blog/passkeys-webauthn-nextjs-authentication/)
- [Keamanan Rantai Pasok Software: SBOM dan Sigstore](https://www.matthewswong.com/id/blog/software-supply-chain-sbom-sigstore/)
- [Rotasi Kredensial Otomatis: Strategi yang Tahan Audit](https://www.matthewswong.com/id/blog/automated-secrets-rotation-strategy/)
- [Mengenkripsi Secrets di Git dengan SOPS dan age](https://www.matthewswong.com/id/blog/sops-age-encrypted-secrets-git/)
- [UU PDP No. 27/2022: Panduan Kepatuhan Developer untuk Hukum Perlindungan Data Indonesia](https://www.matthewswong.com/id/blog/uu-pdp-compliance-developer-guide-indonesia/)
- [Arsitektur Keamanan Zero Trust untuk Aplikasi Cloud-Native: Panduan Praktis](https://www.matthewswong.com/id/blog/zero-trust-security-architecture-indonesia/)

---

- HTML version: https://www.matthewswong.com/id/blog/category/security/
- English: https://www.matthewswong.com/en/blog/category/security/
- Site index for agents: https://www.matthewswong.com/llms.txt
- Sitemap: https://www.matthewswong.com/sitemap.xml
- API description (OpenAPI): https://www.matthewswong.com/openapi.json