A ten-minute baseline for linux server hardening on a small VPS: key-only SSH, a deny-by-default firewall, fail2ban and updates, plus the Docker and ufw trap.
Docker's new agent sandboxes put each agent in its own microVM. Here is why I'm removing docker.sock mounts from agent containers, and the hardening I'd…
I used to open a port every time I needed to show a client a staging dashboard. Here's the Cloudflare Tunnel setup that replaced that…
A new paper says LLMs catch 60% of JavaScript vulnerabilities and SAST catches zero. The zero is rigged. The per-CWE table underneath is what I'd…
The Rust team says fake job calls are being used to hijack crate owners. I read the arrayref timeline and a first-hand account, then changed…
Postgres encryption at rest is two different questions. What LUKS already covers, what pg_vault_tde adds, what stays plaintext, and the 1.7.1 TOAST upgrade trap.
A Purdue study got Qwen, Mistral and Llama to 'verify' a fake developer with a quiz they wrote themselves. What that means for your agent's…
PostgreSQL Anonymizer 3.2 adds seeded pseudonymisation and blocks superuser masking. How I replaced a risky staging dump with a masked role, with the SQL.
Laravel 13.30 adds chunkBy() for adjacent grouping and finally stops Storage::path() escaping the disk root. What changed, what breaks, and what to grep for.
An AI agent audited my Laravel app and got it wrong. Laravel Auditor's 75 evidence-first rules and read-only collectors fix the guessing problem. Here's how.