Open Source

Weekly roundup: Password strength, self-serve BAA, and AI updates

This week on the Appwrite blog, we shipped new Auth controls, made BAA acceptance self-serve for Pro organizations, covered Anthropic’s latest Claude …

Startup Security Guide & LLM CISO

An open-source security guide, compliance checklist, and LLM-based virtual CISO persona for startups -- with specialized coverage for foreign companie…

Headless Browser Detection in 2026: What Still Trips Up Playwright

Playwright is the best browser automation library in 2026. It's also the most fingerprinted, the most detected, and the most patched in anti-bot datab…

CBC Bit Flipping Explained: Why Encryption Alone Doesn't Guarantee Integrity

Most developers learn a hard lesson at some point in their careers: just because data is encrypted doesn't mean it’s safe from tampering. It’s an easy…

Claude Code in Production: The Guardrails Nobody Talks About (Until Something Leaks)

Your Claude Code session just spit out a perfect PR description, refactored three services, and drafted commit messages for the entire sprint. Clean. …

Stop Leaving Containers Exposed: Practical AppArmor Profiles for Podman and Docker on Linux

Containers give us isolation, but by default they still share the host's attack surface more than many realize. AppArmor (and its cousin SELinux) lets…

SharePoint silently retired the EnableAzureADB2BIntegration setting in May — and your old guest links break in July

If you administer a SharePoint Online tenant, the EnableAzureADB2BIntegration setting is the thing you used to flip to choose between the legacy Share…

Vibe citing: how KPMG used AI to write a report about AI and AI made them look like fools

vibe citing: how KPMG used AI to write a report about AI and AI made them look like fools by t474-r0b07 There are companies that charge you to tell yo…

Batfish marks Huawei VRP as unsupported — so I built a source-traceable IR for it

If you do network automation, you reach for Batfish . And if you've ever pointed it at a Huawei box, you've hit the wall: Batfish's own source marks H…

Preview Auth0 Changes Safely with Deploy CLI Dry Run

Managing your Auth0 tenant configuration as code shouldn't be a "guess and check" process. In this video, I'll demonstrate how to use the Auth0 Deploy…

LLM reviewers are useful, but some PR checks should stay deterministic

AI coding agents are getting better at opening pull requests. That changes the review problem. A normal review asks whether the code looks correct, wh…

The Affective Blind Spot: How Support Systems Fail When Incentives Eclipse Care

When a support system breaks, its real incentives show. A field report on affective blindness, governance, and why bots escalate hostility but never h…

Malware in Arch Linux AURs now inserting Russian spam into shell configs

The LLM Is Not the Final Authority: Building Trust Infrastructure for AI Agents

The Problem Nobody Wants to Say Out Loud Most LLM agent deployments have a quiet assumption baked into their architecture: the model will behave. Not …

Discovering PII Inside InterSystems IRIS

Data privacy regulations such as GDPR, LGPD, and HIPAA demand that organizations know exactly where Personally Identifiable Information (PII) lives in…

MCP OAuth: Connecting Agents to Protected Servers

Static API keys in client config are the easy way to authenticate an MCP server and the easy way to leak a credential. The Model Context Protocol's an…

MCP Gateway: What It Is and Why Agent Fleets Need One

An MCP server exposes tools. delete_repository , create_charge , execute_query . The agent calls whatever it decides to call, and the server runs it. …

Slack MCP Channel Allowlists: Stopping Agents Posting to #general

It is 11:47 on a Tuesday. An agent finishes a long-running task, decides the team should know, and calls post_message with channel: "#general" . The m…

JWKS explained: what every developer should know

When it comes to security, certificates are used everywhere since the early days of the web. While storing them in PEM/DER format has always been comp…

X Just Shipped an MCP Server. It Exposes 131 Tools With Zero Access Control.

X (formerly Twitter) just released xmcp , an official MCP server that wraps the entire X API v2. It is the largest social media platform to ship a fir…

Your AI Agent Has Push Access to Every Repo

Your coding agent just merged a pull request to main, deleted three files it thought were unused, and created a new repository called temp-debug-works…

Your Coding Agent Can Delete Any File on Disk

Picture this. You ask your coding agent to "tidy up the config files." It interprets that broadly. It overwrites .env with what it thinks the defaults…

spring-batch-db-cluster-partitioning v2.0.1 — Security Patch

This is a quick heads-up: v2.0.1 of spring-batch-db-cluster-partitioning is out — a drop-in security patch with no API changes. 🔒 What's fixed Spring …

Introducing Security Profiles for Container Permission Management

Introduction In this article, I want to introduce Security Profiles , a feature I added to Raind , a container runtime I have been developing. In a pr…

AI is shipping code faster than security was built to handle

AI coding tools have done something nobody planned for: they've made the security review cycle the bottleneck. Not CI. Not deployment. Security. Snyk'…

Your Terraform state file is a plaintext secrets store. Mine was too.

Here's a fact that's easy to forget until it bites you: a Terraform state file stores resource attributes in plaintext — and that includes secrets. RD…

Can I Replace My Wyze Cam With an Old Android Phone in 2026? What That $29.99 Renewal Is Really Buying

Originally answered on Quora in early June 2026 as a "can I just stop paying Wyze?" question. This is the dev.to canonical at T+7d, expanded with the …

What Is Shadow AI, and Why It's a Real Security Problem

Shadow AI is the unapproved use of AI tools at work. Here is what it actually is, why it creates security and compliance exposure, and how Bifrost Edg…

I built a Terraform security scanner that lives inside GitHub PRs

The problem IAM wildcards and public S3 buckets keep slipping through Terraform code review. Tools like Checkov and tfsec exist but they live in CI, r…

Auditing Kubernetes Manifests With AI: A Practical Workflow

A senior K8s engineer I work with audits manifests faster than I read them. He's seen so many patterns that "missing readinessProbe on a Deployment th…