Compliance & SecOps
SOC2/ISO patterns, zero-trust, secrets management, audit-ready IaC.
Articles
How to Remove Files from Git History Safely
An advanced GitHub guide to deleting files normally or rewriting Git history, with safety checks for secrets, collaborators, tags, and force-pushes.
Supply-Chain Security in the AI Coding Era
How AI coding assistants change JavaScript supply-chain risk — hallucinated packages, slopsquatting, blind installs, lifecycle scripts — and a practical human-in-the-loop approval workflow.
JavaScript Dependency Security: Managing Vulnerabilities with npm, Bun, and pnpm
An operational engineering guide to lockfiles, audits, safe upgrades, overrides, and CI enforcement for JavaScript projects using npm, Bun, or pnpm.
Secure Package Version Pinning for npm, Bun, and pnpm
How to install an approved JavaScript dependency at an exact version, keep the lockfile authoritative, and update security patches deliberately.
pnpm Audit: Find and Fix Dependency Vulnerabilities Safely
A practical pnpm audit workflow for tracing vulnerable dependencies, applying narrow fixes, using overrides carefully, and enforcing lockfile consistency in CI.
Bun Lifecycle Script Security: Using trustedDependencies Safely
How Bun's trustedDependencies control reduces install-script risk, what it does not protect, and how to review the packages allowed to run scripts.
How to Review an AI-Suggested npm Package Before Installing It
A practical checklist for validating AI-suggested JavaScript packages before they enter a repository, CI runner, or production dependency tree.
The Risk of Shipping AI-Built Apps With Unresolved Dependency Vulnerabilities
Why zero known vulnerabilities matters for AI-built SaaS, and a safe npm audit workflow using overrides instead of npm audit fix --force.
How AI Supports Security Remediation Without Replacing Human Judgment
AI can accelerate security remediation by summarizing findings, drafting fixes, and explaining impact, but humans must own risk decisions.
DevSecOps for AI-Built Applications
AI-built applications need DevSecOps guardrails for generated insecure code, dependency vulnerabilities, secrets leakage, and risky deployment paths.
The Death of .env Files: Automated Secret Rotation with Terraform
Hardcoded secrets in CI/CD variables are a compliance failure waiting to happen. A walkthrough of AWS Secrets Manager rotation, codified in Terraform.
Terraform is Your Auditor's Best Friend
How to use Infrastructure-as-Code to prove immutability and traceability for ISO and SOC2 audits — automatically.
NAT Gateways are Leaking Your Data (and Your Budget)
A technical takedown of the default Public Subnet + NAT Gateway pattern. Why VPC Interface Endpoints are cheaper, more secure, and audit-friendly.
Killing the Bastion Host: Zero-Trust Access for Fintech
Why SSH keys are a liability. Use AWS SSM Session Manager and identity-based access for compliant operational workflows.
Logs are Your Forensic Evidence: Structured Security Logging
Text logs are useless at 3am during an incident. A guide to JSON structured logging, CloudWatch Insights, and the fields that actually matter for forensics.
The Region Nuke Test: Why IaC is Your Ransomware Policy
True disaster recovery isn't backups. It's the ability to re-hydrate your entire environment in a fresh region from Terraform, in hours, with confidence.