Engineering essays from the bench.
War stories, architecture decisions, and the occasional tirade. Written by the engineers who shipped it.
Your CI Runner Is the Target: The TanStack and AntV npm Attacks
TanStack packages shipped with valid provenance from a poisoned CI cache. What the May 2026 npm attacks mean for your GitHub Actions setup.
LMDeploy CVE-2026-33626: Your Image URL Field Is an SSRF Endpoint
An LMDeploy image loader SSRF was exploited 12.5 hours after disclosure. How to lock down any LLM endpoint that fetches user URLs, with tested Python.
Axios npm Supply Chain Attack: How It Works and How to Respond
How the March 2026 Axios npm attack compromised a 100M-download package to deploy a cross-platform RAT, plus detection and remediation steps.
Just-in-Time Admin Access Across AWS, Azure and GCP
Replace standing cloud admin with time-bound access: Entra PIM, Google Cloud PAM and AWS Identity Center with TEAM, plus break-glass and access reviews.
Post-Quantum Cryptography Migration: A Practical Guide
Migrate to post-quantum cryptography: FIPS 203, 204 and 205, crypto inventory, Mosca's risk model, hybrid ML-KEM TLS with OpenSSL 3.5, and the deadlines.
Identity and Access Management: A Modern IAM Strategy Guide
Build a modern IAM strategy covering SSO, MFA, RBAC vs ABAC, privileged access management, cloud IAM, and zero-standing-privileges for enterprise security.
Phishing Defense Strategies: Controls That Actually Work
Phishing defense that works: SPF, DKIM and DMARC done right, phishing-resistant MFA, mailbox hardening, fast reporting, and what to do when someone clicks.
SOC 2 for Startups: A Practical Guide to Your First Audit
What SOC 2 requires, Type 1 vs Type 2, which Trust Services Criteria to scope, the controls auditors test, and how a startup produces the evidence.
Penetration Testing Methodology: Scope, Run and Act on a Test
How a penetration test works end to end: types, standards, scoping, rules of engagement, reading findings, fixing them and retesting before the next audit.
Zero Trust Architecture: A Practical Implementation Guide
Implement zero trust architecture step by step: NIST SP 800-207 components, identity and device signals, policy as code, service identity and segmentation.
