Security Engineering
Threat models, trust boundaries and controls for systems that hold credentials, execute code and call tools on your behalf.
Auditing Agent Tool Calls: Logging That Survives an Incident
Six fields worth recording per tool call, why arguments matter more than tool names, four alert rules that produce few false positives, and why the log pays for itself before any incident.
Prompt Injection Through Tool Descriptions and Tool Output
Tool descriptions are attacker-supplied text sitting in the same context as your instructions. Where hostile content enters, why filtering fails, and four controls that limit the damage.
Credential Boundaries: What an Agent Should Never Be Able to See
The difference between an agent seeing a secret and using one, why wrapper scripts beat environment variables, and how to scope agent credentials so a steered session stays contained.
Shell Execution and Blast Radius: What an Agent Can Actually Reach
Granting shell access grants everything the shell reaches. What that includes on a typical laptop, four levels of containment, and why command allow-lists don't hold.
AI Gateways and Data Retention: Enforcing Policy in the Request Path
What zero data retention actually guarantees, why a gateway turns per-developer configuration into a real control, routing by data classification, and the limits of redaction.
Hardening the Local Toolchain: Prompt Injection on a Developer Machine
Where untrusted text enters an agent's context on your own laptop, four controls ordered by return, and the session split that turns a possible compromise into a contained one.
Multi-Tenant Codebases: Make the Unsafe Query Impossible to Write
Why tenant isolation cannot rest on instructions, binding tenant from request context rather than arguments, the surfaces that leak besides queries, and a test that covers endpoints added later.
Gating Irreversible Actions: Controls That Don't Depend on the Model
Sorting agent actions by reversibility and visibility, why the strongest control is simply not granting the credential, and the limits of confirmation prompts.
Capability Attestation and Tool Poisoning: Trusting What a Server Claims
MCP has no way to verify a server does what it declares, and tool definitions are re-fetched every connection. How to pin them, review them, and contain what a server can reach.
Reviewing Third-Party MCP Servers Before You Install Them
A tiered review process short enough to actually run: publisher, source, behaviour and descriptions, plus the pinning and containment that keep working when the review was wrong.
Securing a Local Agent Daemon: Loopback Is Not a Boundary
Why an unauthenticated daemon on 127.0.0.1 is reachable by every process running as you, token files and ephemeral ports, path traversal, and constraining what it will do regardless of caller.
The MCP Threat Model: Where Trust Actually Breaks Down
Why the Model Context Protocol attracted 30+ CVEs and a DoD advisory within eighteen months: three protocol-level weaknesses, and why the whole context window is one trust domain.
Unauthenticated Sampling: When an MCP Server Drives Your Model
MCP sampling lets a server request completions on your account, inverting the usual direction of control. Why it is a documented attack vector and how to constrain it.
Implicit Trust Propagation: Why Provenance Dies in the Context Window
Content loses its origin the moment it enters the context, and tool chains launder it further. The tainted-session model, and how to split research from action.
Other pillars
- Context Architecture — How a codebase explains itself — context files, documentation and conventions structured so the right material is found at the right time, by a person or a tool.
- Tooling & Integration — How the pieces fit together: editors, build systems, CI, protocols and the day-to-day mechanics of shipping software.
- Workflow Architecture — Designing the loops work happens inside — instruction design, migrations, test-driven cycles and the gates that keep a codebase coherent over time.
- Codex vs Claude — Practical comparisons across execution, security, cost, speed, orchestration, planning, integrations and verification — each examined as a decision a working developer can test.
- Higgsfield AI — A practical field guide to Higgsfield's generation, camera, consistency, advertising, audio and editing workflows — including the limits hidden by feature names and the checks that prevent wasted renders.
- Flow vs Higgsfield — A beginner-focused comparison of Google Flow and Higgsfield across models, mobile use, story building, camera control, editing, integrations and the real cost of accepted video.
- Humanoid Robots — Practical buying guides for commercially offered humanoid robots, separating published specifications from configuration, integration, safety, privacy and procurement obligations.
- ChatGPT vs Grok vs Claude Code — A practical comparison of three increasingly broad AI products across identity, interfaces, files, autonomy, search, coding, media, memory, integration, safety and the work each is best equipped to own.
- Tesla Roadster — Evidence-aware engineering guides to twenty-five announced, proposed and prototype Roadster features — separating Tesla's published targets from executive claims, visible concepts, engineering inference and unsupported expectations.