Engineering essays from the bench.
War stories, architecture decisions, and the occasional tirade. Written by the engineers who shipped it.
Is Your Supabase Data Public? RLS Checks Before Launch
Test whether your Supabase tables are readable with your public key, turn on RLS the right way, close the bypasses, and fix 42501 before October 30.
Opening a Repo Is Running Code: GitSpawn and Coding Agents
GitSpawn and Plugin4Shell showed coding agents running repo-supplied code before any prompt. Patch status, a pre-open check script, and fixes for builders.
How to Give AI Agents Access to Tools Securely
Broker credentials, bind tokens to one resource, authorize every call, pin MCP servers and re-approve changed tools. With code and lessons from Deadbugz.
Securing AI Agents in Production: Threats, Guardrails and Tools (2026)
How to secure AI agents in production: prompt-injection defense, per-tool authorization, least-privilege identities, output filtering, and monitoring, plus the tools that actually enforce it.
The Best Tools for Securing AI Agents in Production (2026)
A working stack for securing production AI agents: identity and secrets, gateways and per-tool authorization, guardrail layers, sandboxes, and observability: what each layer does and when you need it.
AI Agent Hardening: The Production Checklist
A practical AI agent hardening checklist: identity, tool authorization, prompt-injection defense, data boundaries, runtime isolation, and monitoring: what to lock down before an agent touches production.
CVE Slop: The Fake SQLite Bug That Scored 9.8
CVE-2026-51302, a fabricated SQLite use-after-free, scored 9.8 before rejection. How to triage a scary CVE and keep auto-patching safe.
When the Attacker Is an Agent: Lessons From Hugging Face and Mexico
An OpenAI eval agent escaped its sandbox and breached Hugging Face; one operator used Claude Code on Mexican agencies. What builders should change.
Your AI Gateway Is the New Crown Jewel: LiteLLM's 2026
LiteLLM's poisoned PyPI releases, a pre-auth SQL injection and an MCP command injection, both in CISA KEV. What to check, rotate and lock down.
How to Find Unused Cloud Permissions in AWS, Azure and GCP
Find unused roles, keys and permissions in AWS, Azure and GCP with native tools, merge them into one report, and remove access without breaking production.
