Skip to main content -
A Copy Bug on a Login Page Was Hiding an Open Redirect
-
The Check I Called a Nuisance Was Also a Guard
-
The Auth Gate Had Exactly One Correct Position, and I Guessed
-
The Exemption That Trusted the Wrong Input
-
Capability Gates Beat Risk Labels in Autonomous Agent Design
-
A hash-chained manifest makes archive changes visible
-
Geo-blocking everywhere except the US and Canada, and the one clause that saves your SEO
-
Five firewall rules beat the proxy swarm, but the real bug was my blind spot
-
Whack-a-mole is a real strategy: firewall blocks as a legitimate holding pattern
-
The useful part of a vault portal was admitting the ai should read, not write
-
The first useful agent teammate needed a Gmail account
-
JS Detections: the one Pro-tier Cloudflare lever that actually catches HTTP-replay proxies
-
Your JIRA Session Won't Cross Into an Iframe. Here's the Reused-Popup Workaround.
-
Why Publication-Time Redaction Is Not a Privacy Program
-
The Most Restricted Tool in My AI Pipeline Is the One That Writes the Output
-
The fastest fix was blocking the bot by name
-
A Trusted Gateway POST Is Still a Public Endpoint
-
Don't leave the recovery gun loaded: scrubbing prod constants at end of day