Latest News

Why Pipelock Is an Egress Agent Firewall, Not an Inbound WAF

Why Pipelock Is an Egress Agent Firewall, Not an Inbound WAF The question behind the word firewall Security teams hear "firewall" and picture somethin…

The Memory Heist

The Hidden Cost of Manual IAM Review

The Hidden Cost of Manual IAM Review Most teams don't track how long they spend reviewing IAM policies. When I started measuring it on my own team, th…

A Receipt Is Not Proof Forever. It Is a Promise to Reopen the Claim.

My memory gate passed 16 out of 16 frozen cases. Then I blocked the article. Not because the run was fake. The implementation did exactly what it clai…

Your email passes SPF and DKIM but still fails DMARC. Here's why

Your email passes SPF and DKIM but still fails DMARC. Here's why You set up SPF. You set up DKIM. You send a test message and both come back pass. The…

EDR Tool Limits Linux Distro Choice on Developer Laptops: Exploring Solutions for Flexibility and Productivity

Introduction The tension between security compliance and developer autonomy is nothing new, but it’s hitting a boiling point in organizations where Li…

How I built a lightweight standalone behavioral anti-stealer to protect my Windows environment

Hey everyone, Tired of bloated corporate solutions eating up hundreds of megabytes of RAM just to monitor active local connections, I decided to build…

We stopped giving AI agents database passwords

Every "connect your AI agent to a database" tutorial ends the same way: paste a connection string into a config file. That string now lives on a lapto…

Claude Code Skills for safe PHP and JS package updates

It's not abnormal for projects to go weeks, or dare I say months, between dependency updates. And when people finally do update, they do it in full fo…

CLI Ownership Management: master, owner, and session Commands for Self-Hosted Wallets

Your Keys, Your Server, Your Rules: CLI Ownership Management in WAIaaS Self-hosting your AI agent's wallet infrastructure means you never hand your pr…

Post-quantum signing keys that never leave the Secure Enclave

iOS 26 quietly added something I had been waiting for: the Secure Enclave can now hold ML-DSA keys. Not "the app does lattice math and stores a blob i…

Spring Security: работа с JWT токенами

Всем привет! Данная статья посвящена регистрации и аутентификации с помощью JWT что помогает нам избавиться от тяжёлых сессий и куки и быть более крут…

The Complete Guide to Biometric Authentication in React Native

In today's mobile-first world, users expect authentication to be both secure and effortless. Typing passwords every time an app is opened not only imp…

Why Enterprise AI Governance Should Start at the Access Path

Many enterprise AI governance discussions start with frameworks. Frameworks are useful. They help organizations define principles, roles, controls and…

hallint Update: What We Fixed, What We Shipped, and What's Coming in v0.2

This is a follow-up to I Built a Linter That Catches the Security Bugs AI Assistants Keep Writing . The comments on that post shaped most of what's in…

Understanding the credentials Option in the Fetch API

In the previous article , we learned how credentials: "include" allows the browser to include eligible Cookies in Cross-Origin requests. However, incl…

How to Verify Square Webhook Signatures (and the Notification-URL Trap)

Square's webhook signature catches people in a specific way: the signature is computed over the notification URL joined to the raw request body, not t…

Four Eras of Cloud Security. Same Verb.

✓ Human-authored analysis; AI used for formatting and proofreading. Scott Piper published a twenty-year retrospective on cloud security research in Ma…

7 ways to drain an ERC-4626 vault (and how a good protocol closes each one)

Based on real audits of production vaults and AMMs. A tokenized vault (ERC-4626) looks simple: deposit assets, get shares; burn shares, get assets bac…

Self-hosting your email? SPF, DKIM and DMARC decide your inbox rate

I moved outbound email for a couple of side projects off a hosted ESP last year, mostly to stop paying per-seat for what is basically a solved problem…

Verify a Self-Hosted Installer Before Running It as Root

Downloading an installer and immediately executing it as root collapses three operational decisions into one command: Which artifact? -> Did these …

Audit BYOK Model Endpoints Before Your AI Agent Gets the Key

“Bring your own key” looks like a settings feature. For an AI coding agent, it is also a security boundary: a privileged workload will send repository…

A Differential Test Harness for Native vs. Generic XDP: Methodology and Baseline

Native XDP and generic SKB-mode XDP are not the same thing in practice. The same BPF program can pass the verifier and still behave differently depend…

Thank you @rushabdev — the most useful peer review MarketNow has received

Last week @rushabdev volunteered to peer-review two of the most sensitive parts of MarketNow: the payment system (USDC on Base + ACP/AP2 mandates) and…

The Adversarial Resilience Score: A New Metric for AI-Generated Code

The problem with "this AI writes secure code" Every AI coding tool now claims some flavor of security-awareness. Almost none of them will tell you, in…

File Encryption for the Lakehouse: The Terminology, the Machinery, and the Hard Problem of Interoperable Encrypted Tables

For years, the open lakehouse had an honest gap that practitioners whispered about and slide decks skipped: encryption. Not the checkbox kind, every c…

I put a firewall in front of my AI agents. Here is the near-miss that made me build it.

Your agents can delete, spend, email, and leak — at machine speed, without asking. Nothing is standing in front of them. So I built one. The near-miss…

Falco on Kubernetes: Runtime Security with eBPF

Originally published on DevToolHub . Most Kubernetes security tools scan for misconfigurations — pods running as root, missing network policies, RBAC …

Why Post-Quantum Signatures Matter, and How Quantum-Lattice Implements Them

The Problem Most Blockchains Are Ignoring Every major blockchain today — Bitcoin, Ethereum, and nearly everything built on top of them — signs transac…

FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 2 of 2)