A date is not a version: strict parsing under OSV ranges
A vulnerability range is a claim about ordering, and it is worth no more than the version parser sitting underneath it. Walk an OSV range's events i…
Team Management
⚑ Сообщить о проблемеПоследние новости Team Management от Tech News
Medical record anonymization
Short answer Under Brazil’s LGPD (Lei Geral de Proteção de Dados), medical record anonymization is a lawful means to process health data without con…
Node.js Email Service: Auditing Deliverability, Template Testing, Preview, and Domain Auth
A compliance notice changes the email-service decision because a pleasant template editor and a provider-level "delivered" status are not an audit r…
How to write a security.txt (RFC 9116), and why EU software makers now need one
A security.txt file tells security researchers how to reach you when they find a vulnerability. It is a plain text file at /.well-known/security.txt…
5 Public-Record Checks for KYB Entity Verification
Know Your Business (KYB) starts with a boring question: does this company actually exist, and is it in good standing? Most onboarding flows still tr…
The EU AI Act Deadline Was Postponed. Your AI Architecture Wasn't.
Europe moved its hardest rules by sixteen months. What that actually tests — and the one rule that did land. On 2 August 2026, the EU AI Act's oblig…
Picking an eQMS for a 200-person Class II device shop — a pragmatic comparison
I work in a 200-person Class II medical device company with two QA/RA folks, three embedded-hardware teams, a small supplier-quality group, and engi…
AI Governance 101: What ML Practitioners Actually Need to Know
AI regulation isn't abstract policy anymore. If you're building systems that touch hiring, credit, healthcare, or law enforcement, there are now leg…
The Tragedy of the Clean-Handed Auditor
"I could save them if they'd only listen..." Hey, you. Yeah, you: the compliance or governance person who stumbled across this blog. Who isn't part…
Compliance-grade pentesting is a scan wearing a suit
You paid for a PDF document that was passed off as a penetration test. You spent money on a penetration test. All you received was an export from a…
From Retrospective Liability to Proactive Capability — A Path to Crypto-Agility and Compliance with Embedded Security Requirements
NON-PAPER This paper is distributed solely for discussion purposes. It reflects an independent analytical perspective and is not presented on behalf…
Aligning NHI Governance With Financial Services Regulatory Expectations
Aligning NHI Governance With Financial Services Regulatory Expectations Explore how NHI governance, secrets management, and risk framing support reg…
I Compared 6 Ways to Legally Pay Dev Contractors in Russia, Belarus, and the CIS in 2026
I pay dev contractors across a dozen-plus countries, and the one rail that works everywhere else — a plain international wire — reliably breaks for…
AgentLedger: Audit Trails for AI Agents That Matter
The Decision Nobody Can Explain In 2026, according to McKinsey's State of AI 2024 report , 72% of organizations now use AI in at least one business…
A Remote Developer You Treat Like Staff Is Legally an Employee, Not a Contractor
Key Takeaways Misclassifying a contractor as an employee creates real financial exposure — back taxes, employer FICA, wage claims — not just a paper…
France's e-invoicing mandate lands 1 September 2026. The developer's playbook.
The deadline nobody can opt out of On 1 September 2026, every business established in France that is subject to VAT — whether or not it actually cha…
Where usability files actually break — and what I do about it
I stopped treating the usability file as a compliance artifact years ago — it’s where product design and real people collide. When it’s done badly,…
What KYB regulations actually demand (and where most implementations quietly fail)
TL;DR: Global organisations faced £1.23 billion in KYC/AML penalties in H1 2025. TD Bank's £3 billion fine was not really about money laundering. It…
How to Build a Compliant Fintech App in the UAE
The UAE fintech sector spans three distinct regulatory authorities. Whether you are building for the CBUAE-licensed mainland, the DIFC, or the ADGM,…
Part 5 of 6: The Regulation That Cannot See the Bias It Was Built to Catch.
TL;DR: The EU AI Act's high-risk provisions take effect August 2026. Your multi-agent pipeline is covered. But the regulation doesn't define "bias,"…
The Delve Scandal Proved SOC 2 Is Broken — Here's What Micro-SaaS Founders Should Do Instead
You just watched a $32 million YC startup implode because they faked SOC 2 evidence for 494 companies. The Delve scandal, broken by Captain Complian…
We spent 6 months feeding our compliance data to a major cloud AI. Here's what we got back.
TL;DR: We built our first generation of compliance tooling on top of one of the big three cloud AI platforms. We fed it our screening data, our edge…
CLOUD Act, GDPR и ваш DNS: что на самом деле может ваш провайдер
Сразу важное: я не юрист. Я инженер, который пилит свой DNS-резолвер по ночам, и читал законы не от хорошей жизни, а потому что это мой бизнес, и мн…
HIPAA + HRSA + FTCA + OSHA at an FQHC: One Compliance Stack, Four Rulebooks
FQHCs run on a four-rulebook compliance regime — HIPAA, HRSA OSV, FTCA deeming, OSHA. The mistake we see most often is treating them as four separat…
Why our eQMS ran in parallel for 18 months — and what I’d do differently
I’ve been responsible for maintaining a Class II product’s QMS during one of the messiest migrations I’ve seen: an 18‑month parallel run where the o…
72 Hours to Report a Breach Why Most Organizations Still Get It Wrong
Most organizations have a breach response plan somewhere. It is probably a PDF, it is probably from 2022, and it is probably never been tested. That…
The US Government Just Made AI Agent Governance a National Priority
On Monday, NIST's Center for AI Standards and Innovation launched the AI Agent Standards Initiative — a coordinated federal effort to develop securi…
Review gating vs. review routing: what changed in 2024 (and why it matters)
What the FTC actually said in October 2024 In August 2024 the Federal Trade Commission finalized 16 CFR Part 465 — the Consumer Reviews and Testimon…