Security & design blog
Where a security mindset meets design decisions.
Practical, no-hype articles on keeping websites and software secure — written while pursuing cybersecurity expertise and applying it directly to design and development work.
How to Make a Website Secure: What Actually Matters
The practical fundamentals that keep a site safe — not the buzzwords, the habits that actually reduce risk.
AI & SecurityThe AI Effect on Security: How to Defend Against AI-Driven Threats
Attackers are using AI to move faster and sound more convincing. Here's what actually changes for defense.
AI & SecurityExtended Reasoning in AI Models: What 'Higher Reasoning' Means for Security
Newer AI models can spend more computation 'thinking' before they answer. Here's what that changes for security work — and its risks.
Data SecurityHDF5 Datasets: The Security Risks Hiding in 'Just a File Format'
HDF5 is everywhere in machine learning and scientific computing — and it's rarely threat-modeled the way an executable would be.
Web SecurityServer-Side Template Injection: Why Jinja and Friends Are Riskier Than They Look
Template engines are built to be powerful. That's exactly what makes injection into them dangerous.
Web SecurityArbitrary Code Execution: The Vulnerability Class That Ends the Conversation
Not all vulnerabilities are equal. ACE means the attacker isn't asking permission anymore.
AI & SecurityAgentic DevSecOps: What Changes When AI Agents Are Part of the Pipeline
Autonomous agents are starting to write code, open pull requests, and touch infrastructure. Security has to keep up.
Risk & OperationsThe Risk Hiding Inside Automation: What Gets Traded Away for Speed
Every automated workflow is also a shortcut around the human judgment that used to catch mistakes before they scaled.
Incident ResponseThe OODA Loop: A Faster Way to Think About Incident Response
A decades-old military decision framework turns out to be one of the sharpest mental models for defending a website.