Git commit signing exists precisely to answer “who actually vouches for this commit?” — and almost nobody uses it, and almost nothing forces the question. A 2025 longitudinal study
Track Vulnerabilities With a Feed Reader
Security advisories are one of the few places on the internet where an algorithmic feed is actively the wrong tool, and almost nobody talks about it that way. RSS security monitori
V8 Sandbox Security: Why a Memory-Safe Language Would Not Fix V8
Before it defends anything, V8’s sandbox gives something away. The readme in V8’s own source tree, loaded on 9 September 2026, states the assumption in one sentence: Further, it is
Salt, Slow Hashes, and the 1979 Paper That Still Governs Your Password Table
Every password-storage checklist says roughly four things: never store the plaintext, use a deliberately slow hash, give every record its own salt, and raise the cost parameter as
Secure AI Agents: The Prompt Injection Trifecta
The scariest AI agent is not the one that writes a strange paragraph. It is the one that can read private data, process untrusted instructions, and send information somewhere else.
Container Registries Explained: GitHub for Container Images
You’ve built a container image — a self-contained bundle of your app and everything it needs. Now what? It’s sitting on your laptop. To get it onto a server, share it with a teamma
TCP Sequence Number Attacks: What Happens When a Threat Model Expires
Here is the entire glossary entry for “ISN” in RFC 793, September 1981: “The Initial Sequence Number. The first sequence number used on a connection, (either ISS or IRS). Selected
HttpOnly Cookies and XSS: The Flag Stops Theft, Not Use
RFC 6265, the April 2011 cookie standard, defines the flag in one sentence: “The HttpOnly attribute limits the scope of the cookie to HTTP requests.” Read that sentence the way cod
Two Fields, One Conclusion: Never Make the Model the Enforcement Point
Machinery-safety engineers and LLM security researchers do not read each other’s literature. They publish in different venues, use incompatible vocabulary, and would probably disag
Can AI Read Long Documents? Why the Middle Still Needs a Human
You upload a 40-page lease, a stack of medical records, or a loan agreement, and ask an AI chatbot to summarize it, flag the risky clauses, or answer a question buried somewhere in









