Blog
Notes and longer teaching pieces — delivery, application security, systems, and the tools around them.
Backends that have to stay up
A Python service that authenticates users and holds data is part of the security story. Reliability, access control, and hardening belong in the same backlog as features.
Read article
Scope the attack surface you actually run
A useful pentest follows what is reachable — the web app, the APIs behind it, and the identity paths that bind them — not a generic checklist printed for a different product.
Read article
Security belongs in the pipeline
Release hardening is cheaper when access, secrets, and deploy paths live next to the code — not on a separate track after production is already live.
Read article