Archive
All logs.
The full record. Observations, principles, and post-mortems from building AI systems for security.
- Engineering What Your Engineering Team Actually Needs to Build for DPDP Every DPDP explainer tells you what the law says. None of them tell you what to build. Here's what your engineering team actually needs to ship to be compliant — consent storage, erasure APIs, breach detection, and audit trails.
- Notes Your AI Agent Is a Third Party Opening an AI agent on your repo sends your source code, secrets, and business logic to a third party. We need to treat it like one.
- Engineering LLM Readiness Score: Is Your Codebase Safe for AI Agents? LLM coding agents read your entire codebase. If there's a leaked API key, a hardcoded credential, or a vulnerable dependency, it goes straight into the prompt. The LLM Readiness Score is a single number that tells you whether your codebase is safe for AI-assisted development.
- Engineering We Published Our First Coding Agent Skill Our first open-source skill is live on Skills.sh and GitHub. codebase-summary analyzes any codebase and produces structured output through a three-phase parallel agent pipeline. Here's what it does and why the pattern matters.
- Notes Accepted into Anthropic's Cyber Verification Program I've been accepted into Anthropic's Cyber Verification Program (CVP) — enabling verified access to Claude's full dual-use capabilities for legitimate defensive security work. The timing, against the backdrop of the Fable 5 and Mythos 5 access debate, makes who-gets-frontier-AI-for-security a strategic question, not a theoretical one.
- Field note On Order and Systems