28 articles tagged Cybersecurity
WAF and bot management: what they miss
WAFs and bot managers filter known-bad requests, not business logic. Map blind spots, tune rules safely, and add application-layer controls.
16 min read · 9 November 2026
Pagination for large datasets: offset vs cursor
How offset and keyset pagination behave on large datasets, where each fails, and how to ship signed cursors that stay correct under writes.
15 min read · 8 November 2026
Distroless images: smaller attack surface
How to move runtime containers to distroless bases, measure the reduction in packages and CVEs, and keep scans blocking in CI.
13 min read · 2 November 2026
Prompt injection: what breaks first in prod
Why prompt injection defeats prompt-level defenses, and how to bound the blast radius with tool allowlists, argument scoping, URL filtering and confirmation gates.
15 min read · 27 September 2026
AI Supply Chain Security: Trust Boundaries for Model Artifacts
How to reason about trust boundaries for AI artifacts when pickle, torch.load and remote code execution are the format, plus a practical detection stack.
16 min read · 19 September 2026
Computer-use agents: the permission trap
GUI agents inherit a human's full permissions and leave no semantic audit trail. Here is how a policy layer, a reduced interface and structured logs fix that.
15 min read · 19 September 2026
MCP hidden cost traps
How misconfigured autoscaling, over-permissive IAM and secret-lease churn create a cost feedback loop on managed container platforms, and how to break it.
13 min read · 12 September 2026
LLM risks underestimated in OWASP Top 10
The OWASP LLM Top 10 covers prompt injection, but production failures cluster in tool use, latency budgets and supply chain. How to measure and mitigate each.
9 min read · 30 August 2026
PyPI poisoned models hit prod in 2025
How to pin, hash and audit Python packages and datasets so a poisoned model or tampered dataset cannot reach training or production.
11 min read · 25 August 2026
Least privilege for agents: the config line nobody writes
Why permissive agent tool defaults break in production, and how to add runtime, context-aware policy checks before every tool call.
14 min read · 10 August 2026
eBPF observability in 2026: what actually works
A practical guide to production eBPF observability and runtime security: kernel requirements, verifier failures, ring buffers, pinning, and how to measure overhead.
14 min read · 9 August 2026
Agents create incidents at 2am
Why autonomous agents that can open, mutate, or page on incidents cause 2am page storms, and how write boundaries and idempotent alerting fix it.
12 min read · 6 August 2026
Senior role projects: 3 real paths
Build three portfolio projects that demonstrate tenant isolation, retry-storm handling, and event sourcing, with concrete ways to measure each claim.
16 min read · 5 August 2026
Prompt Injection Is Not Your Biggest LLM Data Risk
Prompt injection dominates LLM security checklists, but poisoned training data and label drift often cause more damage. A pipeline-stage model for triage.
17 min read · 3 August 2026
Purpose-built beats general AI tools
When a general AI platform beats a purpose-built stack, how to choose, and how to measure latency, cost and fallback behaviour yourself.
16 min read · 19 July 2026
Red-teaming agents without killing velocity
How to embed lightweight adversarial testing for LLM agents into pull requests: fuzzed payloads, resilience assertions, shadow canaries.
11 min read · 17 July 2026
7 ways to measure prompt platform ROI in 2026
How to attribute token cost, latency and developer time to prompt and agent platforms, with instrumentation recipes, failure modes and a decision checklist.
14 min read · 8 July 2026
AI model poisoning: 3 real attacks on datasets
How data, model, and dependency poisoning enter AI pipelines, plus concrete controls for provenance, review, sandboxing, and rollback.
15 min read · 4 July 2026
Prompt injection’s hidden AWS tax
How unsanitized prompt templates leak instructions, trigger retry storms, and inflate token bills — plus concrete hardening steps and code.
12 min read · 3 July 2026
Stop false positives in CI scanning now
Static ignore files rot as dependencies change. A triage layer between scanners and PR comments filters alerts using live context instead.
14 min read · 3 July 2026
AI scanners overlook real vulns
AI scanners catch pattern-level flaws but miss logic bugs. Learn a layered approach using deterministic rules, fuzzing, and runtime monitoring.
12 min read · 2 July 2026
Who owns AI-generated code?
AI can write code, but a human still signs off on behavior. Here is how to make code ownership explicit with prompts, tags, and a security gate.
10 min read · 27 June 2026
API abuse patterns rising in 2026
A layered architecture for stopping credential stuffing and scraping: client integrity tokens, cohort-based rate limiting, and behavioral scoring at the CDN edge.
12 min read · 24 June 2026
CI/CD for AI code: test, secure, rollback fast
A CI/CD pattern for AI-assisted code changes: deterministic locks, prompt-injection checks, smoke tests, metrics gates, and blue-green rollback.
13 min read · 23 June 2026
Defending APIs Against Amplification, Stuffing and Smuggling
How cache-stampede amplification, credential stuffing and HTTP/2 request smuggling work, plus edge admission, idempotency keys and circuit breakers that blunt them.
13 min read · 20 June 2026
Tiered API abuse defense: match cost to attacker economics
Five API abuse patterns that inflate cloud bills, why edge-only blocking fails, and how to build tiered defenses with measurable cost-per-request targets.
11 min read · 20 June 2026
Earning Developer Attention Without a Marketing Budget
How contribution-first marketing works for developer tools: micro-snippets, upstream docs, package managers, and how to measure each channel yourself.
11 min read · 13 June 2026
Context-aware security gates that cut CI alert noise
How to filter CI security findings by pull request diff so scanners surface only what the change actually affects, with policy-as-code examples.
12 min read · 12 June 2026