Retrieved Text Is Part of the Prompt
There is no parser inside a language model that separates the instructions you wrote from the document it just retrieved. Every control that assumes there is one fails in the same direction.
Application Security
Securing the software you build: threat modelling, secure design, and AppSec programme management.
27 articles
Fail Open by Default: What a Pre-Production Review Found
A pre-production security review of a mobile game backend produced seven merged fixes in one day, and almost none of them added a control that was missing.
The Cheapest Control Is the One That Deletes the Exposure
A chat integration appeared to require a public webhook endpoint into a machine I own, and the transport that removed the endpoint entirely cost less than any control I would have put in front of it.
Most Audit Findings Are Drift, Not Missing Controls
Nine findings came out of one adversarial audit. Two were exploitable defects and five were divergence between what the documentation claimed and what the code did.
Shipping a Control That Can Lock Out Your Own Users
Device attestation is a control where a correct implementation and a botched rollout produce the same 403, so the rollout mechanics matter more than the cryptography.
When the Remediation Is the Defect
A security finding about swallowed email errors was fixed correctly, and the same commit is why the notification emails stopped arriving for four days.
Two Platforms Need Two App Clients, Not a Looser Audience Check
Adding Android to a backend built for iOS forced a choice between relaxing JWT audience validation and issuing a second client identity, and the cheaper-looking option was the one that destroyed information.
The Finding Count Fell and the Severity Did Not
Five review passes over one backend in seven days. The finding count fell every time, the top severity band did not move until the last pass, and two of those top findings were defects the pass before had introduced.
When Remediation Creates New Findings
A batch of twenty-seven security fixes closed cleanly and produced a critical regression plus fifteen new findings inside the hour, because the firewall at the heart of it had been added to the template and attached to nothing.
Review the Tool List, Not the System Prompt
A GenAI security review that spends its budget on whether the model can be talked into saying something forbidden has assessed the half of the system that does not act. The half that acts is the tool list.
AppSec Governance in Platform-First Organizations
As platform teams own more delivery pathways, AppSec governance has to shift from ticketing to policy-driven enablement.
Security Architecture in an AI-Accelerated World
As AI capabilities accelerate, security architecture has to evolve from static reviews to faster, risk-informed design guardrails.
Software Supply Chain Security After SLSA and SBOM
SBOMs and provenance frameworks are useful, but only when teams connect them to real build controls and response workflows.
Factorial Separation of Duties for Modern AppSec Compliance
Breaking high-risk activities into smaller, verifiable components lets teams build roads instead of climbing mountains — and makes AppSec compliance continuous rather than ceremonial.
The DevSecOps Toolchain: Build vs. Buy Decisions
Build vs. buy in DevSecOps isn't a tooling preference debate. It's an operating-model decision with long-term security and delivery consequences.
The DevSecOps Maturity Model: Where Does Your Org Stand?
DevSecOps maturity isn't about tooling volume. It's about how consistently security controls produce better outcomes at delivery speed.
Software Bill of Materials: Your New Security Requirement
SBOMs are moving from optional artifact to expected control. Here's how to make them operationally useful instead of performative.
Log4j: Why Software Composition Analysis Isn't Optional
Log4Shell exposed what many teams already suspected: you can't defend what you can't inventory. SCA is now foundational, not optional.
Open Source Vulnerability Management at Enterprise Scale
Managing open source risk at enterprise scale requires process discipline, ownership, and signal-focused prioritization — not endless alert volume.
OWASP Top 10 in Practice: What Actually Matters
The OWASP Top 10 is useful, but only if teams translate it into real engineering decisions and risk priorities.
Application Security Program Management: Beyond the Tools
AppSec maturity is less about tool count and more about operating model discipline, ownership, and measurable outcomes.
Software Supply Chain Security: A Framework for 2021
After SolarWinds, software supply chain security moved from niche concern to board-level priority. Here's a practical framework for 2021.
SolarWinds and the Software Supply Chain Wake-Up Call
SolarWinds exposed a hard truth: trusted software channels can become attack channels. Here's what security leaders should do next.
The Hidden Risks in Your CI/CD Pipeline
Fast pipelines can quietly become high-risk pipelines. Here are the security gaps I see most often — and how to close them without slowing delivery.
Threat Modeling for Non-Security Teams: A Practical Guide
Threat modeling isn't just for security specialists. Here's a practical framework product and engineering teams can use without slowing delivery.
DevSecOps Is Not Just Shifting Left — It's Shifting Everywhere
'Shift left' was a good start, but it's no longer enough. Modern DevSecOps demands security controls across the entire software factory.
The Real Cost of Ignoring Software Composition Analysis
Most enterprises don't know what's inside the software they ship. Software Composition Analysis isn't optional anymore — here's what ignoring it actually costs.