AppSec Lead Brief: recheck JWT and agent execution boundaries
JWT verification failures, Docling local-file disclosure, vm2 sandbox breaks, and Dependency-Track 5.2 identity improvements.
Field notes
What I am learning from architecture decisions, security reviews and the less tidy parts of building software.
AppSec Lead Brief: check your cache and sandbox boundaries
Next.js patches, a critical Wasmtime sandbox flaw, and practical checks for tenant isolation and developer tooling.
AppSec Lead Brief: patch Next.js image routes and recheck build trust
This week's engineering priorities: Next.js image-generation exposure, TeamCity ransomware, device-code phishing and Rust parser updates.
AppSec Lead Brief: an exploited identity API and two Rust cryptography checks
Cisco ISE exploitation makes identity infrastructure the immediate priority, while two Rust advisories require configuration-aware dependency checks.
AppSec Lead Brief: Artifactory token flaws turn patching into incident response
Two additional Artifactory token flaws are now confirmed exploited, while a malicious Rust crate shows why developer workstations belong inside the software supply-chain threat model.
The API Knew Who I Was, but Not What I Was Allowed to Touch
A practical AppSec story about broken object-level authorization, tenant isolation, Microsoft Entra ID, FastAPI, Rust, PostgreSQL, and the evidence a secure API should leave behind.
UI/UX Simplification Has a Cost: The Technical Depth Behind a Simple Screen
A principal architect's guide to the hidden state, security, reliability, and service-boundary costs behind apparently simple web application experiences.
Secure the execution boundary, then prove the supply chain
Consequential application-security and software supply-chain developments for Rust, Python, React, PostgreSQL, and Microsoft SQL Server teams.