Tag

Security

21 posts

November 2026

The Name That Matched Twice: Unicode Normalization, Grapheme Clusters, and Getting Bengali Text Right The same Bengali name can arrive as two different byte sequences, and your unique index, your search box and your audit log will each disagree about whether it is one … Engineering 26 min read

October 2026

The Username That Ate the Password: Argon2id, NIST SP 800-63B-4, and Storing Passwords in 2026 Between July and October 2024, an Okta login path accepted any password for some users, because bcrypt reads only the first 72 bytes of its input and a long username … Research 24 min read The Primary Key That Knew What Time It Was: UUIDv7, RFC 9562, and Choosing Identifiers That Age Well RFC 9562 replaced the 2005 UUID specification in May 2024 and added UUIDv7: a 48-bit Unix millisecond timestamp followed by random bits, so identifiers sort by creation … Research 28 min read The Login Link Landed in Spam: SPF, DKIM, DMARC, and the Year DMARC Became a Standard If your product signs people in with a one-time code or a magic link, email is part of your authentication system, and three DNS records decide whether that email … Research 30 min read The Instruction Was in the Ticket: Designing LLM Agents That Survive Prompt Injection EchoLeak, the GitHub MCP leak, and the Supabase support-ticket exfiltration all had the same shape: an agent read text an attacker wrote, and that text chose the agent's … Research 27 min read The Token That Published the Worm: Trusted Publishing, Sigstore, and Provenance After Shai-Hulud Shai-Hulud did not exploit npm. It read publish tokens out of developers' .npmrc files and environment variables, used them to push poisoned versions of the victims' … Research 27 min read

September 2026

The Certificate Nobody Renewed: 47-Day TLS, ACME Renewal Information, and the End of Revocation as a Safety Net The 200-day certificate limit has been in force since 15 March 2026. The 100-day limit arrives on 15 March 2027 and the 47-day limit two years after that, with … Engineering 26 min read The Logout That Didn't: Session Revocation, Shared Signals, and the Half-Life of a Stolen Token Every system can issue a session. Almost none can reliably end one. A password reset revokes a refresh token, but the fifteen-minute JWT in the attacker's terminal keeps … Research 28 min read The Allowlist Was the Bug: Strict Content Security Policy, from Nonces to Trusted Types Most Content Security Policies in the wild do nothing against cross-site scripting. Google's 2016 study of 26,011 unique policies found 94.72% of them bypassable, mostly … Research 28 min read Secret Zero: How SPIFFE and the IETF's WIMSE Drafts Kill the Credential That Never Expires Every distributed system accumulates credentials that outlive the services they were minted for: an API key in a CI variable, a cloud access key in an environment file, a … Research 24 min read

August 2026

MCP Authorization: How the AI Agent Protocol Learned OAuth the Hard Way In its first four months, the Model Context Protocol asked every server author to build a miniature identity provider from scratch. It took a blog post, a security … Research 22 min read HTTP Message Signatures: How RFC 9421 Turned a Decade of Ad Hoc Signing Into One Spec Before February 2024, every API vendor invented its own way to sign an HTTP request: AWS built SigV4, Stripe and GitHub built timestamp-plus-HMAC webhook headers, and the … Research 23 min read Audit Logs That Don't Lie: Engineering Trustworthy Audit Trails Most audit logs are diaries — written in good faith, full of gaps, and useless the day they matter. An audit log's actual job is to be believed under hostile questioning: … Engineering 19 min read

July 2026

Your Admin Panel Doesn't Need React: The Server-Rendered Renaissance for Internal Tools Internal admin panels have different constraints than consumer SPAs: same-origin, session-authenticated, operated by a handful of trusted-but-audited humans, and … Engineering 19 min read The 202 That Tells You Nothing: Anti-Enumeration Engineering in Auth Systems Every difference between your system's answer for a user that exists and a user that does not is a database query an attacker runs for free. This post treats … Research 18 min read The Bot That Opened Merge Requests: Push vs Pull for Config, Credentials, and License Distribution When an artifact expires and renews on a schedule — a TLS certificate, a software license, a signing key set — somebody has to move the fresh copy to everyone who needs … Engineering 18 min read Rate Limits Are a Contract: Algorithms, Keys, State, and the Fail-Open Question Nobody Wants to Own A rate limit is not a throttle knob — it is a published promise with two failure modes, and most teams have never decided which one they signed up for. This post works … Engineering 21 min read

June 2026

Signing Things That Must Outlive RSA: ML-DSA, Hybrid Signatures, and the Engineering of Long-Lived Trust A signature you verify today cannot be retroactively forged by a quantum computer built in 2035 — which is exactly why the signature migration is misunderstood. The … Research 20 min read The API Key Is the Tenant: Identity Models That Survive Multi-Tenancy Most cross-tenant data leaks are not exotic exploits; they are a missing WHERE clause, a trusted X-Tenant-ID header, or a query that resolved the tenant from one input … Engineering 19 min read Passkeys in Production: The Sharp Edges Nobody Puts in the Demo The WebAuthn demo takes an afternoon. Production takes a year, and the hard parts are nowhere near the ceremony code: an rp_id decision you cannot revise after launch, a … Research 20 min read OAuth DPoP: How Demonstrating Proof of Possession Makes Token Theft Boring Bearer tokens are cash — whoever holds one can spend it. DPoP (RFC 9449, September 2023) replaces that model with sender-constrained tokens: the client keeps a private … Research 22 min read

All posts