ai-engineering
AI Agents Are Running Real Attacks: Which of Your Controls Break First
--- The headline version of this story is that AI is now hacking companies. That framing is useless to anyone who has to actually…
#security
19 posts RSS
compliance-engineering
Key Rotation Without Downtime: Never Generate a Key in a Migration
--- Third post from the compliance-ready backend kit, after nested JWTs and append-only audit logs. Key rotation is the control ev…
compliance-engineering
Append-Only Audit Logs in Postgres: Your Trigger Misses TRUNCATE
--- Second post from the compliance-ready backend kit, after nested JWTs. This one is about the audit log, which is the control an…
compliance-engineering
Nested JWTs in Node.js: Decrypting a Token Is Not Verifying It
--- I have been building a compliance-ready backend kit: a NestJS and TypeScript monorepo where every capability maps to a named c…
ai-engineering
Securing LLM API Keys with AWS KMS
A prompt-injection researcher points your app's own debug endpoint at itself, triggers an unhandled exception, and your error hand…
ai-engineering
Prompt Injection: A Threat Model for LLM Apps
Your support agent has a new superpower. It reads the customer's ticket, looks up their account, and drafts a refund. To do that w…
scaling-javascript-nodejs
Row-Level Security for Multi-Tenant SaaS in Postgres
A support engineer runs a quick query to debug a customer complaint. She forgets one WHERE tenant id = $1 . The dashboard now show…
fintech
Designing Webhooks: Delivery, Retries, Signatures
A customer completes a payment. Your billing provider fires a webhook to POST /webhooks/stripe , your server is mid-deploy, and th…
auth-and-identity
OAuth 2.0 and OIDC: A Backend Engineer's Guide to Login
Here is the question OAuth was invented to answer: how do you let an app do something on your behalf without handing it your passw…
auth-and-identity
Passkeys and WebAuthn: How Passwordless Login Actually Works
A password is a secret you and the server both know. That is the original sin of the whole scheme: because the server has to store…
ai-engineering
Using AI Without Leaking Your Secrets: A Threat Model for AI-Assisted Development
Someone hits an error, copies the whole stack trace into a chat window, and asks the model to "just figure this out fast." Buried…
encryption
Loading Secrets at Runtime Without Leaking Them: config(), the Keystore, and run
Part 3 of 3 on @faizahmed/secret-keystore . Part 1 was the threat model; Part 2 was the CLI. This part is how your app reads secre…
encryption
Encrypt Your .env with One Command: The secret-keystore CLI
Part 2 of 3 on @faizahmed/secret-keystore . Part 1 covered the threat model; this part is pure hands-on. By the end you'll have an…
encryption
Your .env Is a Loaded Gun: A Saner Threat Model for Node.js Secrets
Part 1 of 3 in a deep-dive on @faizahmed/secret-keystore . New here? Start with the Complete Guide. For the original incident writ…
encryption
Encrypted .env for Node.js with AWS KMS: The Complete Guide
A year ago I would have told you a .env file was fine. Then we patched a CVSS 10.0 RCE in Next.js (CVE-2025-66478) and spent the n…
Stop Putting Secrets in process.env: Encrypt Env Vars with AWS KMS
This post starts with the production problem we hit in late 2025, the critical security vulnerability in React Server Components a…
scaling-javascript-nodejs
Secrets Sprawl in Node.js Projects: Detection, Prevention & Secure Deployment (2025)
If a credential can be found in your code base, CI logs, or Slack archive — it’s not just a secret; it’s a risk. By 2025, leaked c…
auth-and-identity
How to Prevent Replay Attacks with JWTs: JWS vs JWE and Fingerprint Validation in Node.js
In this post, we’ll explore what replay attacks are, how JWS and JWE differ, and how to generate + validate session fingerprints u…
auth-and-identity
JWT vs JWS vs JWE (and JWKS): A Developer's Guide
🧠 What is JWT? JWT (JSON Web Token) is a compact, URL-safe token format used to transmit claims securely between parties. It’s th…