WSO2 patched it in April. Attackers exploited it in September.

A practical framework from years of building custom SaaS and ERP systems — not a textbook comparison.

One unexpected incident. One small exception. And a lesson I will never forget.

Infrastructure ACLs only work if you know every listener an appliance exposes. Six steps to enumerate API surfaces, map their…

Introduction

A decision framework for backend and frontend teams weighing where the admin portal should live, and the RBAC, MFA, and gateway controls

AI agent egress control decides what an agent can send out of its environment, where it can send it, and under which authority. A…

Restricting autonomous assistants to GET requests and terminal approvals fails against client-side rendering side channels, and how to…

Do you actually know whether your encrypted reasoning trace is private? Not “probably,” not “the docs say it’s encrypted so it must be…

In my last article, I wrote about a simple but important distinction: authentication tells us who you are; authorization determines what…