Publications tagged "Security"

There’s a moment in too many infrastructure projects where your deploy is blocked on one question: where do the secrets live? This post covers SOPS + age: encrypting secrets directly in git without needing a secrets manager. No servers, no cloud KMS accounts, no chicken-and-egg problem.

Security teams often assume that if one significant risk is acceptable, then multiple similar risks must also be acceptable. I call this the static risk fallacy. This post explores how it shows up across security decisions, why it’s different from normalization of deviance, and how to make aggregate exposure visible.

Hallucinations in large language models (LLMs) are no longer a niche concern. With real-world incidents causing significant damage, the question remains: can you trust an LLM?

The summer of 2025 is seeing AI-powered IDEs move from novelty to default. Cursor, GitHub Copilot, and others promise vibe coding: rapid prototyping through natural-language prompts. Productivity is jumping — yet the trade-offs are already showing. Six patterns are emerging: prediction vs. planning, reactive patch loops, invisible gaps, shifting privacy promises, tooling drift under scale, and erosion of developer choice. Here’s what we’re learning so far — and where the tools need to head next.

LLMs blur the line between code and data – collapsing the security boundary traditional systems rely on. This post diagrams the architectural flaw behind prompt injection, explains why structured output and JSON schemas can’t restore trust, and explores layered defenses from runtime controls to agent isolation.