Security Notes and Writing

Kubernetes security

• Kubernetes Series, Part 1: How Kubernetes WorksPart 1 of a Kubernetes security series: cluster architecture, how a request flows, and the core objects, with diagrams.
• Kubernetes Series, Part 2: Supply Chain SecurityPart 2 of a Kubernetes security series: check what goes into your images and manifests with Syft, Grype, Trivy, kube-linter and kubesec, and choose a registry safely.
• Kubernetes Series, Part 3: Monitoring, Logging and Runtime SecurityPart 3 of a Kubernetes security series: what to log and watch, how to detect attacks inside running containers with Falco, and what to do when a Pod is compromised.
• OWASP Kubernetes Top 10 (2025): A Practical GuideThe OWASP Kubernetes Top 10 (2025) explained simply: what each risk is, a command to check for it, and how to fix it.

Web and API security

• JWT Security: Attacks and Server-Side ValidationHow JWT attacks work (alg, kid, jku, jwk, weak secrets, claim and authorization flaws) and how to prevent each one with server-side validation.
• OAuth 2.0 and OIDC Threat Model: Where Login Flows BreakAn interactive threat model that maps OAuth 2.0 and OpenID Connect authorization bugs to the lifecycle stage where each control belongs.
• PKCE Explained Interactively: Stopping Authorization Code TheftHow the OAuth PKCE extension stops a stolen authorization code from being redeemed by an attacker, explained interactively.

AI and LLM security

• Threat Modeling a Multi-Tenant AI Document PlatformA worked threat model for a multi-tenant AI document analysis platform on AWS: trust boundaries, attack paths, controls, launch priorities and how to test them.
• How LLM Systems Work, With Security Risks and Controls at Every LayerHow modern LLM systems work layer by layer, what can go wrong at each layer, and which security controls reduce the risk.
• OpenAI Prompting and Embeddings: Beginner GuideA beginner guide to prompting and text embeddings, explained in simple language.
• Attention Is All You Need: Beginner Guide to Transformer AttentionA simple explanation of the Transformer attention mechanism from the "Attention Is All You Need" paper.
• GitHub AI Agent Security: Prompt Injection in Dev WorkflowsHow AI agent vulnerabilities affect development workflows, with a walkthrough of a GitHub AI agent issue.
• GitHub AI Agent Attack Flow: Public Issue to Private CodeHow a malicious prompt in a public GitHub issue can lead an AI agent to leak private code, step by step.
• GitHub AI Agent Vulnerability: Security Risks and ImpactThe security risks and impact of the GitHub AI agent prompt-injection issue.
• Exploitable vs Non-Exploitable: GitHub AI Agent IssueA comparison of what is and is not exploitable in the GitHub AI agent prompt-injection issue.

Cloud security and incident response

• Investigating and Containing Compromised AWS STS Credentials Across AccountsA worked AWS incident response: trace a bulk S3 download to an STS session using only one account's CloudTrail, then contain it without taking down the services that share the role.

Study notes

• AWS Security Specialty (SCS-C03) Domain 1: DetectionA visual study sheet for Domain 1 (Detection) of the AWS Certified Security Specialty exam.
• Amazon GuardDuty Study Guide for the AWS Security SpecialtyAn interactive study guide to Amazon GuardDuty: what it sees, what each protection plan adds, how finding severity works, and Extended Threat Detection.
• AWS Security Hub Study Guide (SCS-C03)A study guide to AWS Security Hub for the AWS Certified Security Specialty exam.
• Python 3.11 Data Structures and Algorithms Cheat SheetAn interactive Python 3.11 cheat sheet for the syntax used in data structures and algorithms.