Tag: #security
Writing on GPUs, LLMs, MLOps, Kubernetes — and mindset · 141 posts
Where Developer Tokens Leak — The VSCode 1-Click Token Theft and Secret Hygiene
Dissecting the June 2026 case of one-click GitHub token theft through a VSCode bug, this post traces the paths along which tokens leak in developer environments. It covers PAT permission design, token rotation, secret sc
2026-06-12 · 15 min read #security#github#tokens#devops#secretsPassword Managers in 2026 — 1Password 8 / Bitwarden / Proton Pass / Dashlane / KeePassXC / iOS Passwords / Android Credential Manager Deep Dive
The full 2026 landscape of password managers. 1Password 8, Bitwarden, Proton Pass, Dashlane, KeePassXC, NordPass, Enpass, RoboForm, the LastPass aftershock, iOS 18 Passwords, Android Credential Manager, Apple Keychain, G
2026-05-16 · 17 min read #password-manager#1password#bitwarden#proton-pass#dashlaneKubernetes Admission Policies & Security 2026 — Kyverno (CNCF Graduated) / OPA Gatekeeper / VAP (CEL) / Falco / KubeArmor / Tetragon Deep Dive
The full topology of Kubernetes security in 2026. Kyverno that became CNCF Graduated in November 2024, Rego-based OPA Gatekeeper, the built-in Validating Admission Policy that went GA in k8s 1.30 (CEL), the alpha Mutatin
2026-05-16 · 24 min read #kubernetes#security#admission-controller#kyverno#opa-gatekeeperDevOps Secrets Management 2026 Deep Dive - Doppler, Infisical, HashiCorp Vault, AWS Secrets Manager, 1Password CLI, Bitwarden Secrets, SOPS, age
A complete map of the DevOps secrets management ecosystem as of May 2026. Covers cloud-native SaaS (Doppler, Infisical, HCP Vault Secrets), enterprise vaults (HashiCorp Vault after the IBM acquisition, CyberArk Conjur, A
2026-05-16 · 28 min read #secrets-management#doppler#infisical#hashicorp-vault#aws-secrets-managerStatic Analysis / SAST 2026 — Semgrep / CodeQL / Snyk / SonarQube / Aikido / Trivy Deep Dive
Mapping the 2026 code security tooling landscape — Semgrep (the de facto OSS SAST plus Pro engine and Supply Chain), CodeQL (the heart of GitHub Advanced Security, dataflow king), Snyk Code (SAST+SCA after the DeepCode A
2026-05-15 · 26 min read #security#sast#static-analysis#semgrep#codeqlFrontend Security 2025 — XSS, CSRF, CSP, Trusted Types, JWT, OAuth, PKCE, Passkeys, Supply Chain, SRI (S6 E9)
XSS still tops every CVE report. But 2024–2025 shipped real tools to defeat it: Trusted Types, CSP v3 with strict-dynamic, Sanitizer API. Passkeys replaced passwords for serious products. Supply-chain attacks made SRI +
2026-04-15 · 6 min read #frontend#security#xss#csrf#cspTLS/SSL and PKI Complete Guide — Handshake, Certificate Chain, Cipher Suites, 0-RTT, and the Post-Quantum Era (2025)
Behind the little padlock in the browser address bar lie 30 years of cryptography, trust chains, and protocol evolution. How TLS 1.2 2-RTT became 1.3 1-RTT, how the certificate chain makes you trust a server you have nev
2026-04-15 · 12 min read #tls#ssl#pki#https#certificateOAuth 2.0 & OIDC Deep Dive — Authorization Code, PKCE, JWT, DPoP, FAPI (2025)
OAuth 2.0 and OIDC run billions of times daily, yet most developers understand them only superficially. This guide dissects them from scratch: the four OAuth 2.0 flows, why PKCE became mandatory, JWT structure and pitfal
2026-04-15 · 13 min read #oauth2#oidc#openid-connect#authentication#authorizationThe Complete DNS Guide — Resolvers, DNSSEC, DoH/DoT, Anycast, CoreDNS, and Everything Else (2025)
Everything about DNS — the history of the name system that started with hosts.txt, query flow (stub to recursive to root to TLD to authoritative), record types (A/AAAA/CNAME/MX/TXT/NS/SOA/SRV/CAA/HTTPS/SVCB), EDNS0 and p
2026-04-15 · 25 min read #dns#dnssec#doh#networking#securityDNS Deep Dive — Resolution, Caching, DNSSEC, DoH/DoT, Anycast, and 1.1.1.1 Internals (2025)
Trillions of times per day, yet most engineers understand DNS only superficially. This guide dissects DNS from first principles: hierarchical namespace, recursive/iterative resolution, caching and TTLs, record types (A/A
2026-04-15 · 12 min read #dns#networking#dnssec#doh#anycasteBPF Complete Guide — A Tiny VM Inside the Kernel: Verifier, JIT, CO-RE, Maps, Attach Points, XDP, LSM, sched_ext (2025)
Everything about eBPF — from cBPF in 1992 to eBPF in 2014 to schedext in 2024. The 11-register virtual machine ISA, the verifier's static analysis, JIT compilation, BTF and CO-RE, 17+ BPF map types, 200+ helper functions
2026-04-15 · 31 min read #linux#kernel#ebpf#bpf#xdpContainer & Docker Internals Deep Dive — Namespace, cgroups, OverlayFS, seccomp, Capabilities and Kubernetes (2025)
"A container is not a lightweight VM." Behind a single docker run there are 7 Linux namespaces, cgroups v2, OverlayFS layers, seccomp filters, and Linux capabilities. From LXC in 2008 to Docker in 2013, OCI standardizati
2026-04-15 · 12 min read #docker#container#namespace#cgroups#overlayfsAWS Well-Architected Framework Complete Guide 2025: Six Pillars, Practical Adoption, Cost/Security/Performance
Everything about the AWS Well-Architected Framework: six pillars (Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, Sustainability), practical checklists, Well-Architected Tool usa
2026-04-15 · 14 min read #aws#well-architected#cloud-architecture#security#reliabilitySmart Contract Development Complete Guide 2025: Solidity, Foundry, Security Patterns, DeFi Implementation
Everything about smart contract development. Solidity syntax, EVM fundamentals, Foundry vs Hardhat, OpenZeppelin library, gas optimization, security patterns (Reentrancy/Integer Overflow/Front-running), upgradeable contr
2026-04-14 · 14 min read #smart-contract#solidity#foundry#hardhat#ethereumZero Trust Architecture Complete Guide 2025: Never Trust Always Verify, BeyondCorp, SASE
Everything about Zero Trust! Never Trust Always Verify principles, Google BeyondCorp, microsegmentation, ZTNA, SASE, identity-centric security, least privilege, continuous verification, implementation roadmap, tools (Zsc
2026-04-14 · 24 min read #zero-trust#security#identity#beyondcorp#saseeBPF Complete Guide 2025: Kernel Programming Revolution for Observability, Networking, Security
Everything about eBPF! Safe Linux kernel programming, BCC vs libbpf vs bpftrace, Cilium (networking), Falco (security), Pixie (observability), Tetragon, CO-RE, real-world tracing, performance optimization, production cas
2026-04-14 · 11 min read #ebpf#kernel#observability#networking#securityApplication Security Engineering Guide — OWASP Top 10, Authentication, Encryption, DevSecOps
Everything about application security: OWASP Top 10 vulnerabilities, secure authentication/authorization, practical encryption, secure coding, and DevSecOps pipelines.
2026-04-13 · 16 min read #ai#security#owasp#authentication#encryptionAdvanced CI/CD Pipeline Guide — GitHub Actions, ArgoCD, Tekton, and Security Pipelines
Beyond basic build-and-deploy: security scanning, static analysis, container signing, GitOps, and multi-environment deployments. A comprehensive guide to building production-grade CI/CD pipelines.
2026-04-12 · 18 min read #devops#ci-cd#github-actions#argocd#tektonThe Growth Process (Feedback Loops) & Source Code Leak Response
How do we grow? The science of feedback loops, the art of retrospectives, and how to respond when a source code leak occurs -- procedures and prevention.
2026-04-12 · 15 min read #culture#growth#feedback-loop#security#source-codeOAuth 2.0 & Authentication Complete Guide 2025: JWT, Sessions, SSO, OIDC, Passkey
Everything about web authentication! OAuth 2.0 flows (Authorization Code/PKCE/Client Credentials), JWT (structure/verification/Refresh Token), Session vs Token, SSO (SAML/OIDC), Passkey (WebAuthn/FIDO2), Social Login, Se
2026-03-25 · 22 min read #oauth2#authentication#jwt#session#sso