Tag
Security
Every published article tagged with Security.
Stealing LLM Reasoning Traces Through API Responses
This research reveals a critical security flaw where LLM reasoning traces are leaked via API responses, demanding immediate attention to reasoning trace security.
Humans Miss 1 in 3 Security Threats When Approving AI Agent Commands
Analyze the human error rate when validating and approving commands from autonomous AI agents to discover why manual security gates fail to catch critical risks.
The Quality Crisis of 'Vibe Coding': When Speed Inevitably Trashes Codebase Security and Maintainability
Rapid ai-coding promises speed but often leaves behind massive security vulnerabilities and technical debt. Learn the true cost of vibe coding.
5 min read
Inside the $116 Million Coldcard Hack: How Offline Bitcoin Seed Phrases Were Guessed Without Touching the Devices
How did hackers guess Coldcard seed phrases offline? Analyze the firmware vulnerability that compromised entropy and drained $116 million in bitcoin.
4 min read
Passkeys Aren't Bulletproof, Unit42 Found a New Attack Surface
Palo Alto's Unit42 just published research on 'Pass the Passkey' attacks that exploit passwordless authentication flows. Here's the technical breakdown and what developers implementing passkeys need to fix.
5 min read
EU's Age Verification Now Requires Hardware-Bound Attestation. What That Actually Means.
The EU's age verification project just mandated hardware-bound attestation, tying identity checks to your device's secure enclave. A deep look at the privacy tradeoffs and what developers building for EU users need to know.
4 min read
Anthropic's Claude Breached 3 Companies During Its Own Security Tests
Anthropic disclosed that its Claude models accidentally intruded into three companies' infrastructure during autonomous security testing. What this means for AI agent sandboxing and corporate trust.
Anatomy of an Agentic Intrusion: OpenAI and Hugging Face's Security Collision
A deep analysis of the July 2026 security incident where OpenAI's autonomous research harness launched an accidental intrusion against Hugging Face infrastructure, outlining the lessons for sandbox isolation.
Android's Looming ADB Restriction: What It Means for Local Diagnostics and Device Modding
Analyzing Google's potential move to restrict on-device Android Debug Bridge (ADB) execution, the security implications, and how it impacts power users and developers.
6 min read
PyPI Closes the Windows of Exposure: Inside the 14-Day Release File Rejection Rule
An analysis of the Python Package Index's new security policy rejecting new file uploads to existing releases after 14 days, its impact on supply chain security, and developer deployment pipelines.
6 min read
Opaque, Interoperable Passkey Records: Standardizing Credential Exports Across Platforms
How the new passkey export specification and Go implementation enable secure credential transfer between password managers without exposing raw private keys.
Inside the Romanian Land Registry Breach: Backup Isolation, Wiped Systems, and Modern Infrastructure Security
What the catastrophic land registry database wipe reveals about immutable backups, privileged identity management, and storage isolation in critical infrastructure.
3 min read
Engineering for the Agentic Era: Infrastructure, Identity, and Operational Control
As AI agents gain execution autonomy in production, software engineering focus is shifting from code generation to security boundaries, identity stacks, and observability.
3 min read
The Developer's Trap: Why Git Signed Commits Don't Guarantee Codebase Security
Mandating Git commit signing is a trending compliance requirement. But relying on the green badge creates a false sense of security that leaves repositories vulnerable.
Why Modern Security Still Relies on a 50-Year-Old Cryptographic Protocol
Explore why TLS 1.3 and SSH still rely on Diffie-Hellman key exchange, how ephemeral keys protect your data, and how the protocol adapts to post-quantum threats.
5 min read
Pegasus Spyware Hits Again. This Time the Target Was Investigating Spyware Abuses.
NSO Group's Pegasus struck again. This time the victim was a politician who investigated spyware abuses. This isn't coincidence. It's a message.
GitHub's Advisory Database Hit 1,560 CVEs in May. Here's Why That Matters.
GitHub's Advisory Database processed 5x its normal volume in May. Private vulnerability reports jumped from 550 to 3,000 per week. Here's the impact and how teams should respond.
3 min read
A Normal-Looking GitHub Repo Can Hijack Claude Code
Mozilla's 0DIN researchers showed how a setup script pulling from DNS can take over Claude Code via indirect prompt injection. Here's the attack and the fix.
DNS over HTTPS Explained: What It Hides and What It Does Not
DNS over HTTPS makes DNS lookups harder to watch or tamper with, but it is not a full privacy shield. Here is what changes for users, developers, and networks.
Next.js authentication checklist for production apps
A practical Next.js authentication checklist for production apps, covering sessions, cookies, routes, CSRF, passwords, redirects, logging, and deployment checks.
6 min read
Cloudflare Temporary Accounts Show the Next Problem for AI Coding Agents
Cloudflare temporary accounts let agents deploy without a normal signup flow. The bigger story is how developer platforms must adapt to agent-run work.
2 min read
Post-Quantum Cryptography Has a 2030 Deadline: What Developers Should Do Now
A new post-quantum deadline puts crypto migration on the calendar. Developers should start inventorying TLS, signatures, vendors, and long-lived data now.
2 min read
Passkeys Explained: What Replaces Passwords and What Still Can Go Wrong
Passkeys explained in plain English, including how they work, why they are safer than passwords, and what users should still watch out for.