Environment Separation Is a Claim Until Someone Reads the Config
A production service that answered every check was reading development tables and publishing an index with no version history in it at all.
August 2026
What Dies First When You Retire a Service
Retiring a service is an ordered operation with a preservation gate that has to be verified before anything is destroyed, and a list of consumers that no inventory holds.
What Leaks Through the Pipe That Publishes
A private-to-public sync excluded every file it was supposed to exclude and still published the committer's identity, the commit bodies, and a sentence naming the directory it had just hidden.
July 2026
Your Automation Is a Guest on Someone Else's Origin
A scheduled worker was reading a Cloudflare bot challenge as a rate limit. Classifying it correctly was the right fix, and the first version of that fix doubled the traffic the worker sent.
Retrieved Text Is Part of the Prompt
There is no parser inside a language model that separates the instructions you wrote from the document it just retrieved. Every control that assumes there is one fails in the same direction.
June 2026
Fail Closed on the Server, Fail Open at the Client
Two commits a day apart set opposite failure defaults in the same backend, and what decided each one was not the sensitivity of the asset but who gets refused when the control is wrong.
Fail Open by Default: What a Pre-Production Review Found
A pre-production security review of a mobile game backend produced seven merged fixes in one day, and almost none of them added a control that was missing.
The Cheapest Control Is the One That Deletes the Exposure
A chat integration appeared to require a public webhook endpoint into a machine I own, and the transport that removed the endpoint entirely cost less than any control I would have put in front of it.
Most Audit Findings Are Drift, Not Missing Controls
Nine findings came out of one adversarial audit. Two were exploitable defects and five were divergence between what the documentation claimed and what the code did.
May 2026
Shipping a Control That Can Lock Out Your Own Users
Device attestation is a control where a correct implementation and a botched rollout produce the same 403, so the rollout mechanics matter more than the cryptography.
Freeze, Destroy, and the Grants You Give Back
Two AWS systems went dark seventeen days apart. Deciding how to stop them took more security work than building them did, and the artifacts I preserved were deleted eighteen days later by someone doing a legitimate job.
April 2026
When the Remediation Is the Defect
A security finding about swallowed email errors was fixed correctly, and the same commit is why the notification emails stopped arriving for four days.
Two Platforms Need Two App Clients, Not a Looser Audience Check
Adding Android to a backend built for iOS forced a choice between relaxing JWT audience validation and issuing a second client identity, and the cheaper-looking option was the one that destroyed information.
The Finding Count Fell and the Severity Did Not
Five review passes over one backend in seven days. The finding count fell every time, the top severity band did not move until the last pass, and two of those top findings were defects the pass before had introduced.
When Remediation Creates New Findings
A batch of twenty-seven security fixes closed cleanly and produced a critical regression plus fifteen new findings inside the hour, because the firewall at the heart of it had been added to the template and attached to nothing.
March 2026
The Revert That Reopened a Vulnerability
A Next.js downgrade that fixed a broken static export also put five open security advisories back into the lockfile for fifteen hours, and nothing recorded that as a decision.
Review the Tool List, Not the System Prompt
A GenAI security review that spends its budget on whether the model can be talked into saying something forbidden has assessed the half of the system that does not act. The half that acts is the tool list.
February 2026
Infinite Craft Explorer: What Autonomous Discovery Taught Us
Building an autonomous crafting explorer surfaced real lessons about observability, cost governance, and security posture that apply far beyond a game.
January 2026
Least Privilege for Non-Human Developers
An agent's permissions are whatever its tools can reach, not whatever its role description says, so the policy has to be written at the tool boundary and tested like a control.
What Automating a Zero Trust Assessment Taught Me About Maturity Scores
Writing a maturity score down as a function forces you to answer the scoring questions a consultant never has to say out loud, starting with what an unanswered question is worth.
How CI Security Gates Quietly Turn Themselves Off
A pipeline reporting green while its security tests never execute looks identical to one that passed, and nothing in the default tooling tells you which you have.