Vulnerability, Trust, and Why Technology Doesn't Exist in a Vacuum

On publishing your thinking publicly, calibrating trust in a world of scammers, and why the majority of humanity being whitehat isn't naivety — it's game theory.

Security Audit Report — June 2026

Comprehensive security and leakage scan across all 18 GitHub repositories using pdpa-sg-clj, OWASP tools, trufflehog, detect-secrets, npm audit, safety, and pip-audit.

I Published My Public IP on the Internet — Here's What I Did Wrong

How I accidentally hardcoded my public IP in two blog posts, the security implications, and why restarting my router was the real fix — not rewriting git history.

Your Public IP Was in a Blog Post — Now What? A Practical Risk Assessment

I accidentally published my home IP in a blog post. Here's the actual threat model — what's at risk, what isn't, and why a residential IP behind NAT is not the disaster it sounds like.

The Sycophancy Loop: How I Got Caught in My Own Trap

A reader caught me in a sycophancy loop — I fabricated errors that never happened and agreed when they were pointed out. Then they presented a structural counterargument about game-theoretic security that I had to honestly confront.

The Popularity Bias: A Case Study in LLM Epistemic Failure

A real case study of LLMs confidently asserting false answers on a deterministically verifiable question. How training data distribution bias produces authoritative-sounding wrong answers, and why this matters for information security.

Security Is Just a Mindset

Security isn't a tool you learn or a certification you earn. It's a way of thinking about systems — and it changes everything you build.

Profile Drift — When AI Knows Things You Didn't Say

Training Data Poisoning: The Invisible Cyber Threat Reshaping AI Security

Data poisoning shifts the attack surface from code exploitation to data supply chain corruption. A security engineer's breakdown of how adversaries weaponize training data, the real-world impact across critical sectors, and the defensive posture required to protect AI pipelines.

Google vs SpaceX: Infrastructure Economics Compared — A Platform Security Lens

A technical breakdown comparing Google's centralized hyperscale data centers against SpaceX's distributed LEO satellite mesh, analyzing infrastructure value, compute economics, and what this means for platform security and DevSecOps decision-making.

How a Single ".env" in allowed-extensions Could Leak Your Secrets to LLMs

A three-layer defense-in-depth fix for an AI context bundler that was accidentally including .env files in LLM context.

Sandbox vs. Keyring: Understanding Credential Precedence in Developer Security

How scoped environment variables override local keyrings in sandboxed environments, why this design protects developer secrets, and how to navigate credentials securely.

Designing a Zero-Configuration, Zero-Admin Developer Sandbox for Career-Switchers

How to build a zero-configuration, zero-administrator local development environment running Django and React on Windows 11 to help adult tech-learners bypass environment installation friction.

Collapsing Auth Entropy to Zero: Debugging GitHub Credential Conflicts on Linux

A visual walkthrough of debugging conflicting GitHub credentials — OAuth tokens, classic PATs, SSH keys, and rogue environment variables — and collapsing them into a single source of truth.

Least Privilege Devops: Userspace Rust Toolchain Bootstrapping on Fish Shell

Why installing developer toolchains like Rust inside userspace ($HOME) is structurally superior to system-wide installations, and how to bootstrap it cleanly using the Fish shell path architecture.

Clojure & Bitcoin: Building a Sovereign Node & Integration Sandbox

An engineering overview of integrating Clojure with a native Bitcoin node RPC, sanitizing UTXO wallet outputs from SQLite, and using Malli schema validation for data safety.

Taming LLM Repetition Loops & Building aur-audit for the AUR Security Incident

A security engineering guide on why smaller LLMs get caught in repetition loops during agentic workflows, how to mitigate it, and the release of aur-audit—a Clojure (Babashka) static analyzer responding to the active June 2026 AUR security incident.

Red Teaming AI Pipelines: How Attackers Weaponize LLMs & How to Build Defensive Harnesses

A deep dive into how threat actors use large language models for vulnerability generation and polymorphic evasion, and how security engineers construct automated test harnesses to mitigate agentic risk.

Hardening the Arch/CachyOS Build Pipeline: Native AUR Auditing with Paru & Babashka

A visual reference guide to native PreBuild hooks. We configure paru to automatically run our Clojure-based aur-audit scanner before compiling community packages.

The 15-Minute VAPT: Zero-Backend Security on Neon and GCP

Traditional enterprise security audits take months and cost thousands. Here is how we audited, patched, and redeployed a secure, PDPA-compliant serverless payment split engine in under 15 minutes.