What I Check Before Letting an AI Agent Run a Task
Before giving an AI agent a task, I would review its permissions, inputs, action limits and verification process. A convincing answer is not evidence that an external action…
Read articleBlog
Research, Security & Engineering Insights
Investigations, cloud security, careers, and building in public.
Featured
Start here
All articles
How I Would Test Whether a Cybersecurity Quiz Measures Understanding
A learner can remember terminology without being ready to investigate a problem. I describe how I would evaluate cybersecurity questions for reasoning, clarity and useful feedback.
Read article
Critical PHP RCE Advisory: Patch CVE-2026-109618 and CVE-2026-109619 Now
PHP2Shell exposes PHP web servers to critical remote code execution risks. I explain the affected runtimes, fixed PHP versions, and the checks administrators should complete after patching.
Read article
What a PII Redactor Can Miss
Detecting an email address is easier than detecting every clue to a person’s identity. I explain how to evaluate redaction tools and review what survives.
Read article
A Security Headers Score Is Only Part of the Story
Security headers provide useful browser protections, but a high score cannot establish that an application is secure. I explain what to check behind the grade.
Read article
How I Read a Suspicious Email’s Headers
Email headers can help explain delivery and authentication, but some fields can be forged. I describe how I separate trusted receiving evidence from a sender’s claims.
Read article
Decoding a JWT Does Not Verify It
Reading a token’s claims does not make them trustworthy. I explain the separate jobs of decoding, signature verification, claim validation and authorisation.
Read article
What “Zero Tribal Knowledge” Would Require from a Software Team
Documentation becomes useful when another engineer can make a change or recover a service with it. I explain how I would reduce reliance on knowledge held by one…
Read article
Automating Database Administration Without Losing Control
Repeated requests for tables and views should become a controlled delivery process. I describe how I would automate warehouse changes while keeping access and recovery reviewable.
Read article
Your Dashboard Shows Totals. Who Can Read the Underlying Records?
An aggregate dashboard can hide personal records on screen while its underlying connections still have broad access. I explain how to review that boundary.
Read article