Archive
All logs.
The full record. Observations, principles, and post-mortems from building AI systems for security.
- Engineering Exploited Before the Patch: What php2shell Says About the Patch Window On October 21, PHP shipped fixes for two unauthenticated remote code execution flaws in the language runtime itself. Exploitation attempts had already been seen four days earlier. Here is what broke, who is exposed, and what to do this week — plus what it tells us about patching in an era of AI-accelerated vulnerability research.
- Engineering Your Next Security Tester Is an AI Agent. Can You Prove It Stayed in Scope? AI security agents can inspect repositories, test hypotheses, validate exploitability, and propose fixes. But an agent capable of finding a serious vulnerability is also capable of crossing a boundary. Trustworthy assessment now requires enforced scope, isolation, traceability, and evidence.
- Engineering What Your Engineering Team Actually Needs to Build for DPDP Every DPDP explainer tells you what the law says. None of them tell you what to build. Here's what your engineering team actually needs to ship to be compliant — consent storage, erasure APIs, breach detection, and audit trails.
- Notes Your AI Agent Is a Third Party Opening an AI agent on your repo sends your source code, secrets, and business logic to a third party. We need to treat it like one.
- Engineering LLM Readiness Score: Is Your Codebase Safe for AI Agents? LLM coding agents read your entire codebase. If there's a leaked API key, a hardcoded credential, or a vulnerable dependency, it goes straight into the prompt. The LLM Readiness Score is a single number that tells you whether your codebase is safe for AI-assisted development.
- Engineering We Published Our First Coding Agent Skill Our first open-source skill is live on Skills.sh and GitHub. codebase-summary analyzes any codebase and produces structured output through a three-phase parallel agent pipeline. Here's what it does and why the pattern matters.
- Notes Accepted into Anthropic's Cyber Verification Program I've been accepted into Anthropic's Cyber Verification Program (CVP) — enabling verified access to Claude's full dual-use capabilities for legitimate defensive security work. The timing, against the backdrop of the Fable 5 and Mythos 5 access debate, makes who-gets-frontier-AI-for-security a strategic question, not a theoretical one.
- Field note On Order and Systems