All posts
2026
-
The CAP theorem of security: business, growth, security
Right now, most companies get to pick two of business, growth and security. That's a state, not a law, which makes it an opportunity.
Security · 2 min read -
Your MFA guards the door. Your session cookie opens it.
Security isn't a one-time thing. If your authenticated session cookie is shared across every subdomain, your marketing vendors are holding the keys too.
Security · Identity · 2 min read -
Approval prompts aren't security: delegating access to AI agents
An AI agent is neither the resource owner nor the service provider. Real control comes from scoped, time-bound delegation built into the services themselves.
Security · Identity · AI agents · 2 min read -
The trouble with email magic links
A possibly controversial take: if your identity provider signs users in through email magic links, it may be time to reconsider it.
Security · Identity · 1 min read -
Identity management for agentic AI
Agents acting directly or on a user's behalf aren't new problems. The real gaps are auditing, authorization and granular access, and agents expose all three.
Identity · AI agents · 1 min read -
Held together by assumptions: a cascading failure at login
A login outage, an instinct to scale up the database, and a sensible optimization that broke an assumption about replication lag nobody had written down.
Infrastructure · Incidents · 2 min read -
Security tip of the day: your old commits still have your keys
Moving credentials out of the code isn't enough if they're still sitting in your git history. Rotate them first, then prune those commits.
Security · Tips · 1 min read -
Placeholder names live forever
Two identity systems, two names I meant to change later: "IAWeb" and ".sk". Both outlived my time on the projects.
Engineering · Identity · 2 min read -
Service users, and an awkward question for per-seat pricing
Credential-less service users fix the shared-account problem. They may also make per-seat SSO pricing look very different.
Identity · Product · 2 min read -
A naive idea for the AI doom debate
Three simple, physical safeguards for data centers that power LLMs. Just not sure if it's really that hard.
AI agents · Notes · 1 min read -
The on-call spiral
Every departure makes on-call more frequent, and on-call that frequent ends up working like having no one on call at all.
Engineering · Incidents · 1 min read -
The agents were for the investors
A dozen agents for development, everything automated. Then the real ask: help stabilizing a fragile product that no one fully understood.
Engineering · AI agents · 1 min read -
Why I don't have a plan B
A friend asked me the same question ten different ways. Here's why I don't have a plan B, and how a round of job interviews turned into customer research.
Startups · Identity · 2 min read -
How a year of lessons fits into one day of building
Asked how I build so much so fast: most of my one-day features are a year of planning, design and compromise I've already lived through somewhere else.
Startups · Engineering · 1 min read -
Passwords became the scapegoat
Looking back at years of credential breaches, almost all were preventable with tools that already existed. Passwords took the blame for six common failures.
Security · Identity · 2 min read -
Eight hours with an LLM, thirty minutes without
An experiment using an LLM to build FIDO MDS attestation support: 14 files, a silent parsing bug, and a rewrite by hand in two files.
Engineering · LLMs · 2 min read -
What are you actually building?
A ground-up identity provider, and why Conway's Law explains so many of the seams in the identity products we use today.
Identity · Startups · 1 min read -
Starting something new
I've started something new. It's in stealth for now, but here's the why: a real gap in identity and access that AI agents are making more acute.
Startups · Identity · 1 min read -
Stop reaching for the TEXT column
Unbounded TEXT columns are everywhere in open source, including security projects. With agents calling APIs directly, the old safeguards are gone.
Security · Engineering · 1 min read -
How least privilege becomes the guideline for *
Everyone roots for the principle of least privilege in theory. In practice, a wildcard written to unblock one team ends up as everyone's guideline.
Security · Identity · 1 min read -
Enterprise Managed Auth: keeping MCP alive and relevant
Enterprise Managed Auth lets companies control which agents run and which MCP servers they reach. It also closes the easy window for selling agents to enterprises.
AI agents · Identity · 1 min read -
StackOverflowError: where did the end condition go?
We all learned early to give every loop and recursive call a controlled end condition. Now smart people run agents as unbounded loops and advocate for it.
Engineering · AI agents · 1 min read -
The bus driver who can't see the traffic
A new security team scans everything, files every CVE and rotates every key. Less than 5% were exploitable, and product delivery stopped.
Security · Engineering · 2 min read -
Your CDN can read your secrets
Secret-swapping proxies for AI agents add a trusted middleman. So do CDNs, which terminate TLS and can read every header. Two habits that limit the damage.
Security · AI agents · 2 min read -
The agent workaround everyone cheered for
A non-developer used an AI agent to automate what a SaaS team hadn't shipped in months. Here's why the celebrated workaround is really a session hijack.
Security · AI agents · 2 min read -
Why would you ever depend on the latest version?
Reading about the LiteLLM incident, I tried to think of a good reason to point at the latest, unbounded version of a dependency. I couldn't find one.
Security · Engineering · 1 min read -
Fun fact: the two teams of scraping
Big companies pay one team to scrape other sites and another to stop being scraped. Guess which one is better funded.
Security · Notes · 1 min read -
Python or TypeScript: are those the only two left?
It took 35 job listings to find one that mentioned C#. With AI in the picture, hiring seems to have collapsed to two language flavors.
Engineering · 1 min read -
My prediction: someone still has to maintain it
Most of the software industry maintains products where one line changes a week. AI writes more code faster, and all of it will need maintaining.
Engineering · LLMs · 2 min read
2025
-
When a verified PayPal email becomes a phishing tool
A real email from a verified PayPal address, with a scammer's message injected into the template. Three simple fixes.
Security · 1 min read -
All code is a liability
What I told a friend worried about AI and engineering jobs: code is a liability, and the context AI needs mostly isn't in the code.
Engineering · LLMs · 1 min read -
Three engineers and one age field
A product manager wants to store and show a user's age. Three engineers respond three very different ways. Which one will the business pick?
Engineering · Identity · 1 min read -
What's the best programming language? It depends
A friend in FAANG engineering leadership wanted a decisive answer. The honest one depends on who's choosing, and for what.
Engineering · 1 min read