Blog
Field notes from production.
Field notes on AI agents, software engineering, and shipping to production without cutting corners.
Featured
How AI agents leak your credentials — and how to stop it
You pair with an AI coding agent in your repo, it needs your token to do the job — and the obvious way of handing it over leaks it. Here is the small, structural fix, from one line to a build-it-yourself walkthrough.
- 5 min read
The OpenClaw leak: how 7% of a skill marketplace exposed API keys
In early 2026, researchers found that 283 of ~3,984 OpenClaw agent skills leaked live credentials — not through malware, but through how they were written. Here is what happened, and the structural fix.
AISecurityDevOpsRead - 13 min read
Static Code Analysis in the AI Age: Obsolete or Indispensable?
With every new generation of AI models, code writes itself faster than ever. Which is exactly why SonarQube and SonarCloud matter more, not less — as a deterministic quality gate that keeps AI-generated code at production grade and stops security holes. Plus two real misconfigurations from a product of my own that show why this setup belongs in practiced hands.
AICode QualityDevOpsRead