SecurityAPI Design
Token Exchange at the API Gateway: RFC 8693 in Practice
OAuth token exchange (RFC 8693) lets your API gateway hand the producer a token that still carries the user, so RBAC keeps working. Hands-on with Keycloak.
15 min read
Security
Security architecture and best practices
SecurityCloud & Infrastructure
Post-Quantum Cryptography: The TLS Inventory to Run Now
Post-quantum cryptography migration can't wait for quantum computers. Run this 20-minute OpenSSL check on your own TLS endpoints today.
11 min read
GovernanceSecurity
Sovereign Cloud Strategy: Residency Is Not Enough
Sovereign cloud vendors sell EU regions and sovereign SKUs, but the US CLOUD Act reaches data by possession, not location. Decide the real threat first.
9 min read
SecurityArchitecture Practices
The End of Phishing: Passkeys Make Lookalike Sites Useless
A passkey registered on bank.com will not activate on bank-secure-login.com. The cryptography enforces the boundary without asking the user to spot the fake. This post covers why traditional MFA keeps failing, what the 2025 adoption numbers actually say, and how to run a working passkey demo on your own machine in 20 minutes.
15 min read
SecurityDevOps
Sandboxed Agents: Giving Your Code Monkeys Their Own Sandbox
Coding agents that can delete your work, mine cryptocurrency, and exfiltrate data are not hypothetical. This post covers how sandboxed execution works, which isolation technologies to choose for your threat model, and how to build a working Docker-based sandbox from scratch.
18 min read
API DesignSecurity
Model Context Protocol: Teaching Your AI to Actually Read the Room
MCP fixes the biggest lie in enterprise AI: that your language model actually knows your data. By providing a standardized client-server protocol for connecting AI systems to real data sources and tools, it eliminates the hallucination problem at its root, while introducing new architectural and security challenges that architects can't afford to ignore.
27 min read
DevOpsSecurity
Git Hooks: Preventing Your Credentials from Going Viral
Git hooks catch AWS keys and tokens before they reach your Git history. A pre-commit setup that runs in seconds and survives contact with real developers.
11 min read
SecurityCloud & Infrastructure
From Login to Least Privilege: A Practical IAM Playbook
The crisis didn’t start with a breach. It started with a routine audit. For the lead architect, the previous months had been spent immersed in crafting what felt like their most elegant solution yet. A new customer engagement platform, fully containerized, multi-region, API-driven, scalable to millions. They had solved for failover. They had solved for latency. They had modeled domain boundaries down to the bounded context. It was, on paper, nearly flawless.
9 min read
Security
The Threat We Didn’t See Coming: Awakening to Threat Modeling
It started like any other digital transformation project: a multinational client, a tight deadline, and the excitement of architecting a greenfield platform in the cloud. We had microservices humming in Kubernetes, event streams flying through Kafka, and pipelines buzzing in CI/CD. Security? Of course, we had it: identity via OpenID Connect, TLS everywhere, secrets in Vault. We had checked the boxes.
6 min read