Whitepapers

DevSecOps Blueprint

A holistic implementation guide to implementing Security-by-Design and effective vulnerability management through a collection of technology-driven, automated processes. The objective is to implement a secure-by-design software development process that empowers engineering teams to own the security for their own digital products.

Jaws Programming Language

Jaws is an invisible interpreted programming language that was created for antivirus research. Since Jaws code is composed entirely of whitespace characters, it can easily coexist with other programming languages to create polyglot code.
Talks

The Expanding Identity Attack Surface: Beyond Human Users

NHIs are everywhere, outnumbering humans 100 to 1, yet are often overlooked. Legacy IGA/SIEMs fail to provide continuous authentication in decentralized environments. We'll dissect the modern identity stack, expose where tech fails, and deliver actionable strategies to secure your hyperconnected NHI landscape.

Securing GitHub Actions Workflows

CI/CD pipelines are critical for delivering code from developers’ machines to production servers. It’s no surprise that the environments, processes, and tools that make up this area – where every single misconfiguration is part of a larger attack surface – are becoming more appealing to hackers.

Jaws Programming Language

Jaws is an invisible interpreted programming language that was created for antivirus research. Since Jaws code is composed entirely of whitespace characters, it can easily coexist with other programming languages to create polyglot code.

Seccomp CI Automation

Seccomp is a Linux kernel security feature that allows you to constrain the syscalls that a process can make. By using automated tools, you can easily generate seccomp profiles for your container images in a CI/CD pipeline.
Blogs

SSH Certificates: A Complete Guide

When it comes to securing access to your Linux servers, the choice of SSH authentication method can make a world of difference. With options ranging from simple passwords to complex certificate-based systems, it's essential to understand the tradeoffs between convenience and security.

Balancing Security and Velocity in Modern Software Development

Developers don’t want to become experts at security, and slowing down for anything is a tough proposition. Security isn’t a problem that will just go away, though.

Self-Hosting Infisical: A Guide to Securing Your Homelab's Secrets

In 2025, the magic of “the cloud” seems to be waning. Companies increasingly see the benefits of self-hosting or taking a hybrid approach. Individuals care about self-hosting too. I'm one of many who've chosen to self-host personal services

The Challenges of Identity Lifecycle Management for NHIs

Identity lifecycle management is one of the most underestimated security risks in many organizations. You may have structured IAM processes that handle the lifecycle of human identities, but what about your non-human identities (NHIs)?

Test security rules without breaking production: Arcjet's DRY_RUN mode

Arcjet is designed to run everywhere - locally, in CI/CD, in staging, and in production. Write unit tests for your security rules and avoid breaking production.

Detection Engineering: A Case Study

In this blog post, we will explore the intricate world of detection engineering. We’ll start by examining the inputs and outputs of detection engineering, and then we’ll illustrate the detection engineering lifecycle.

How to Handle Secrets in Configuration Management Tools

Configuration management tools like Ansible, Chef, and Puppet offer various methods for handling secrets, each with inherent trade-offs. The article explores these approaches alongside modern OIDC-based solutions that enable short-lived authentication tokens for automated processes.

Security Culture: The Best Tool Money Can't Buy

Building positive relationships, sharing knowledge effectively, and making security "cool" are some of the most worthwhile security pursuits.

Open Source Vulnerability Databases Comparison

Essential reading for developers and security professionals alike: a comprehensive comparison of vulnerability databases to help you cut through the noise.

Pipeline Integrity and Security in DevSecOps

Last episode of the series on implementing a DevSecOps program: how to harden your software delivery pipelines to maintain robust security measures.

Secure-by-Design Software in DevSecOps

This new series is about implementing secure-by-design software processes that empower engineering teams. The second part of this DevSecOps program is all about implementing secure-by-design software pipelines.

Vulnerability Management Lifecycle in DevSecOps

This new series is about implementing secure-by-design software processes that empower engineering teams. The first stage of this DevSecOps program: vulnerability management.

How to Handle Mobile App Secrets

Learn why storing secrets in mobile apps is a major security risk, how to manage user and developer secrets properly, and why client-side secrecy is impossible. Find out the best practices for securing mobile app secrets and protecting your data.

How to Become Great at Key Rotation

Secret management can be a complex challenge, especially when you are trying to do it in a way that is right for security. Key rotation is a big piece of that puzzle. In this article, we will take you from zero to hero on key rotation.

Secure Code Review

Reducing vulnerabilities in your software means manual and automated secure code reviews. Download ourhandy cheat sheet to keep your review practice on track.

Securing Infrastructure-as-Code (IaC)

Discover the best practices and tools to scan and secure your infrastructure as code (IaC) throughout the DevOps software development lifecycle. From threat modeling to monitoring, this comprehensive guide offers valuable insights to improve the security, reliability, and consistency of your IaC.

TLAH: Source Code Leaks

Continuing our series about potential attack scenarios, learn how a very easy configuration mistake on GitHub can lead to a major security breach.

TLAH: Malicious GitHub Actions

How can an attacker exploit leaked credentials? In this new series, we try to answer this question by imagining plausible attack scenarios. Fourth case: secrets are stolen with a malicious GitHub action.

TLAH: Hijacked Twitter Accounts

How can an attacker exploit leaked credentials? In this new series, we try to answer this question by imagining plausible attack scenarios. Third case: Twitter API keys are used to pump an altcoin.

TLAH: AWS Keys in Private Repos

How can an attacker exploit leaked credentials? In this new series, we try to answer this question by imagining plausible attack scenarios. Second case: an AWS secret is found in a private repository.

Thinking Like a Hacker: Abusing Stolen Private Keys

How can an attacker exploit leaked credentials? In this new series, we try to answer this question by imagining plausible attack scenarios. First case: an RSA private key is found in a Docker image.

GitHub Actions Security Best Practices

Learn how to secure your GitHub Actions with these best practices! From controlling credentials to using specific action version tags, this cheat sheet will help you protect against supply-chain attacks. Don't let a malicious actor inject code into your repository - read now!

Securing Containers with Seccomp

In this article we present a novel way to protect your container applications post-exploitation. This additional protection is called Seccomp-BPF.

CI Pipelines: 5 Risks to Assess

More and more parts of the software development process can occur without human intervention. However, this is not without its drawbacks. To keep your code and secrets safe, you should add the following security practices to your CI pipeline.

CISO Roadmap: First 90 Days

Come away with a game plan for strengthening your information security program.

Reverse Shell Anywhere

Follow along as I explain how to do sinful things with Linux pipes and rant about the "magic" of Python and the "helpful" ways they buffer your streams.

Black Box Seccomp Profiling

Blindly kneecap your Dockers for security -- trust me bro.

Browserception

Have you ever dreamed of opening up your web browser, navigating to a website, and having a whole other functional browser within that web page???

Gitlab and Reverse Proxies

Me chronicling my troubleshooting of Gitlab not being reachable behind my reverse proxy.

Jaws Programming Language

The first public post about the Jaws programming language that I created in my undergrad research. Jaws is an invisible interpreted programming language!