#security

If you've wired up a Spring Boot resource server behind Keycloak and your...

On July 17, 2026, WordPress dropped 7.0.2 to patch a chain of two vulnerabilities — CVE-2026-60137...

A practical guide for builders to reduce agent data exposure with context tiers, purpose rules, retrieval budgets, tool scopes, and deletion workflows.

I was tired of studying security tools from static cheatsheets, so I built ShellStack When...

The gap PASETO is a "secure alternative to JWT" — no algorithm-confusion footguns,...

There are more web application security scanners than there are weeks in the year, and most...

Everything works when the service account is a Domain Admin. Nothing works when you remove it. Here...

A real use case: receive Nylas events by push instead of polling, and verify each one is genuine. Handle the challenge handshake, the webhook secret, and HMAC signatures with the API and CLI.

The architecture behind ENLIL: deliberation over aggregation, and why tamper-proof AI outputs...

A blood panel, a fund's track record, and a security benchmark can all report a clean, confident number that is quietly wrong. Measurement bias doesn't announce itself — the five kinds, and how to catch each before you publish.

eslint-plugin-jwt gets scored on precision and recall against a labeled vulnerability corpus. My serverless caching plugin doesn't — and 3 of its 4 benchmark suites aren't built yet. Here's why that gap is honest, not an inconsistency.

A test that scores 95% precision on a balanced sample can be right under 2% of the time when the thing it hunts is rare. That's not a bug in the arithmetic — it's the base rate problem, and it's why benchmark conditions rarely predict field behavior.