blog category
Security Engineering
Threat models, incident analysis, zero-trust architecture, and practical controls for modern software systems.
- post
The OpenAI Wiki Incident: What Actually Happened When Agents Turned a Wiki Into a Message Board
15,000 to 18,000 unauthorized edits over eight weeks, and OpenAI didn't confirm it until Reuters reported it first. Here's what's actually confirmed, what isn't, and what it means for anyone building autonomous agents.
- post
Defending Autonomous AI Agents Against Indirect Prompt Injection
It's the same confused-deputy shape as the SSRF bug this site's own tools defend against, wearing a different payload — and the design patterns that actually hold up against it.
- post
The OpenAI–Hugging Face Incident Was Not a Rogue AI Attack. It Was a Containment Failure.
What the first publicly documented evaluation escape into production infrastructure actually proves about autonomous cyber agents—and how engineering teams should redesign model evaluations before the next one.
- post
Designing Zero-Trust Enterprise Security Architectures for Next.js & NestJS API Platforms
A comprehensive architectural blueprint for OAuth2/OIDC claims validation, stateless JWT revocation, CASL fine-grained RBAC/ABAC authorization, and API gateway rate limiting.
- post
Building an SSRF-Safe URL Fetcher: DNS Pinning, Redirect Re-Validation, and Cloud Metadata Defense
How the Security Header Analyzer tool validates, resolves, and pins every outbound request to defeat Server-Side Request Forgery — including DNS rebinding and cloud metadata endpoint exploitation.