Prompt Injection Explained: How Attackers Manipulate AI Applications
Prompt injection has topped OWASP's LLM Top 10 for two consecutive editions, for a structural reason: instructions and data flow through the same …
Security that ships, not slideware.
Practical security for teams that ship fast
Field notes on AI security, access control, APIs and incident response — the boring fixes that actually stop incidents, written for the engineers who implement them.
Latest
All articles →
Linux Kernel CVE Records: Read Stable-Branch Affected Ranges
Every Linux kernel CVE record carries two product entries: git commit ranges and kernel version ranges. We read all 7,987 kernel CNA records published …
EPSS Scores for KEV CVEs: Why New Entries Score Low
An EPSS cutoff of 0.1 misses a quarter of CISA's KEV catalog today, and half of the entries added in the last 90 days. We tracked 113 KEV additions …
What Is Workload Identity and Why Should You Stop Using Static Cloud Keys?
A static cloud key stored on a server is a credential that works until someone remembers to rotate it. Workload identity replaces that with a …
EPSS v5: How Scores Shifted and What to Re-baseline
EPSS v5 (model v2026.06.15) replaced v4 in the daily feed on June 15, 2026. We diffed the last v4 file against the first v5 file: 26% fewer CVEs at or …
OpenVEX Products and Subcomponents: purl Matching Rules
An OpenVEX statement suppresses a finding only when its products, subcomponents and purls line up with what the scanner found. Here is how the go-vex …
Non-Human Identities: The Security Problem Behind Service Accounts and AI Agents
Most identity security programs were designed around human users logging in. Service accounts, API keys, and now AI agents don't fit that model, and …
CVE packageURL: Join CVE JSON 5.2 Records to SBOM purls
CVE Record Format 5.2.0 added an optional packageURL field to affected entries. We counted it across all 400,445 published records: 1.6% carry one, 12 …
CSAF VEX product_tree: Resolve Product IDs to SBOM purls
A CSAF VEX file never puts a purl next to a status. Product IDs in product_status point into the product_tree, often through relationships. Here is …
Browse by topic
All topics →AI Security
Prompt injection, MCP servers, AI agents and the data-leakage risks that come with putting LLMs into production.
AppSec & APIs
Securing applications, APIs, webhooks, secrets and the software supply chain, from code review to CI pipelines.
Identity & Access
Authentication, MFA, passkeys, session security and least-privilege access for people and machines.
Cloud Security
Cloud IAM, workload identity, misconfigurations and zero trust, with a focus on what small teams can actually run.
Security Operations
Incident response, logging, alerting, backups and the processes that keep security work from stalling.
Privacy & Third-Party Risk
Data minimization, PII, GDPR and the SaaS vendors and OAuth apps that can reach your data.
Fundamentals
Plain-English explanations of the core ideas behind security decisions: encryption, the CIA triad, zero-days and more.
How we write
Editorial policy →Start from the real problem
Every article opens with the failure teams actually hit, not a definition they already know.
Give the fix, in order
Rollout orders, checklists and trade-offs you can act on this sprint.
No vendor pitches
Tools are compared on what they change for your team, and sponsored content is always labeled.
Corrected in the open
When advice goes stale or we get something wrong, we fix it and say so on our corrections page.
Got a postmortem or process worth sharing?
We publish practical security writing from engineers and practitioners — no vendor pitches.