What holds up in real projects.
Experience, decisions and technical solutions from real projects — framed for people responsible for software and its outcomes.
Featured
Field notes
How AI agents leak your credentials — and how to stop it
How AI coding agents like Claude Code and Cursor leak your tokens the obvious way — and the structural secret-management pattern that stops it, from one line to build-it-yourself.
ReadMore insights
Architecture, AI engineering, security and developer workflows from practice.
- 9 min read
Shadow AI: you can't secure what you can't see
The question isn't whether your people use AI — they already do, often through personal accounts, out of your sight. What shadow AI means for data protection and compliance, why bans make it worse, and a sober five-step plan that doesn't run on fear.
Read - 9 min read
Can't, not shouldn't: why AI security is architecture, not a rulebook
Most people secure AI agents with prompt rules — “please don’t print secrets.” That is not security, it is a request. Why durable AI security makes the failure impossible instead of forbidding it — with the one question to test every measure against.
Read - 5 min read
The OpenClaw leak: how 7% of a skill marketplace exposed API keys
In early 2026, researchers found that 283 of ~3,984 OpenClaw agent skills leaked live credentials — not through malware, but through how they were written. Here is what happened, and the structural fix.
Read - 13 min read
Static Code Analysis in the AI Age: Obsolete or Indispensable?
With every new generation of AI models, code writes itself faster than ever. Which is exactly why SonarQube and SonarCloud matter more, not less — as a deterministic quality gate that keeps AI-generated code at production grade and stops security holes. Plus a real misconfiguration from a product of my own — and what it takes to make such a setup tell the truth instead of just glowing green.
Read