Tag / The engineering notebook
DevSecOps
5 articles and notes on this topic.
October 2026 in Security: Attackers Went for the Keys, and AI Outpaced Our Patching
October 2026 showed two shifts at once: attackers went after the places where credentials pile up, and AI started finding bugs faster than most teams deploy fixes. Here is what Binance, LiteLLM, Railway, ConnectWise, PHP2Shell and Node2Shell teach, and the changes developers and IT leaders should make now.
The Bottleneck Moved to Review: My SDLC After AI Writes Most of the Code
When a machine writes most of your diff, the constraint stops being how fast you type and becomes how well you review. Here is the SDLC I actually run (the provenance audit, the sandbox, the CI backstops, and the three questions I ask every AI-authored change) plus the parts of review that don't compress and never will.
NVIDIA OpenShell: Policy-Enforced Sandboxes for Autonomous Coding Agents
NVIDIA just open-sourced OpenShell, a policy-enforced sandbox for autonomous AI agents. Four security layers, a privacy router that decides which LLM sees which data, and hot-reloadable YAML policies. How it works and what it solves that nothing else does.
Bảo mật ứng dụng viết bằng vibe coding: hướng dẫn thực tế để tránh bị tấn công
Vibe coding giúp đưa ứng dụng ra thị trường nhanh hơn, nhưng cũng làm tăng nguy cơ phát hành lỗ hổng bảo mật. Bài viết phân tích các sự cố thực tế, quy trình phòng thủ nhiều lớp và những phương pháp rà soát bảo mật mới với AI.
Securing Vibe-Coded Apps: A Practical Guide to Not Getting Hacked
Vibe coding is shipping apps faster than ever, but also shipping vulnerabilities at alarming rates. This guide covers real disasters, practical security measures from secret scanning to endpoint hardening, and SOTA AI-powered review methods to keep your vibe-coded apps from becoming the next breach headline.