On security, AI and how decisions are made.

The largest crypto theft in history did not start with a stolen key. It started with one engineer's laptop and ended with Binance's own systems signing the attacker's withdrawals. What happened, and the lesson under it.

Your GitHub holds your code, your pipeline and your keys. Most people run it like a junk drawer: forgotten integrations, zombie tokens, and bots opening pull requests nobody reads. How the graveyard gets you breached, and the old rule for handing over a key.

What security taught me about trusting an answer, and the decision framework I built Argumont on.

You do not need AI or humanoids to start. A plain-language guide to the parts of a simple robot: body, motors, drivers, controllers, power and sensors.

Why outsourcing security might cost you more than it saves: culture gaps, access, local law, and the real breaches that went through outside teams.

CVE-2024-4577 let anyone run code on a Windows PHP server with one web request. How a single hidden character revived a twelve-year-old bug, how attackers used it, and how to close it.

FedRAMP is how a federal agency reuses someone else's security review instead of doing its own. What it really is, the parts that carry the weight, the honest cost, and a worked example.

If you trained or tuned your own model, the file is a valuable asset, and so is the behavior visible through your API. How attackers steal the weights outright or copy the model by querying it, and how to protect both.

The more a model can do on its own, send mail, move money, change records, delete data, the more a single trick or confident mistake turns into real damage. Why least power beats more power, and where to put a human.

Plugins and tools are the model's hands. They let it fetch a page, run a search, call a service. But the inputs come from the model, which means they can come from whoever injected the model. How to build tools that cannot be turned against you.

The models, datasets and libraries you pull in are dependencies like any other, but with far less mature tooling to check them. How a poisoned package or a tampered model walks in through a normal install, and how to close the door.

Language models are slow and priced by the text they process, so a few shaped requests can burn your capacity or your budget. The attack needs no exploit, just expensive work, and the caps that stop it.

If you train or fine-tune a model, whoever controls part of the data controls part of the model. How a few poisoned records plant a hidden backdoor, a real proof of concept, and what to actually check.

Teams validate what goes into a language model and forget what comes out. But the output is just more untrusted text, and if it flows into a page, a query or a shell, it can carry an attack. The trap and the fix.

OWASP published its first list of the ten biggest security risks in software built on large language models. Here is what each risk means, a real example of each, and the one defense that matters most.

Every major language model is built on the Transformer, a design first published in 2017. What it does step by step, a working attention example in Python, and what the design means for the people building on it.

The new OWASP Top 10 for Large Language Model Applications, turned into concrete checks and code a development team can apply before release.

A fluent answer is not a verified answer. Why language models invent facts, where they do it most, and a checking routine with code that rejects unsupported answers.

On a blockchain the cost of running your code is attacker-controllable, and an unbounded loop can freeze a contract for everyone. The vulnerable pattern, the fix, and why it is permanent.

What happens to the text you type into ChatGPT and similar tools, what has already gone wrong this spring, and a one-page policy a team can adopt this week.

In a medical device the worst case is not a data breach, it is a patient harmed by a wrong dose. A worked threat model of a diabetes tool, and why the ranking has to put safety first.

Improper input validation is the root under most injection bugs. What counts as input, why blocklists lose, and how to check it on the server, with code.

A firewall filters traffic. It does not fix broken code. A story from a client who chose the firewall, what it hid, and the one question that tells a fix from a cover-up.

You are the first security hire. Before any tool, your job is to see what exists and who owns it. A playbook from inventory and threat modeling to SAST, DAST in your pipeline, and making security the default.

IDOR is when an app trusts you to ask only for your own data. How it happens, a real exposure of 885 million records, and the one check that closes it, with code.

Threat modeling is four plain questions you ask before you build, not after. A worked example on a food delivery app entering a new city, with STRIDE and an honest take on scoring.

Language models cannot tell your instructions from the text they read. How prompt injection works, real cases from the last six months, vulnerable and safer code, and the defenses that hold up.

A language model answers the question you typed, not the one you meant. Seven habits, with examples and a test harness, that make ChatGPT and similar tools give answers you can use.

What happens when a request sends the same parameter twice, how PHP, Java, Python, Node.js and others disagree, four attacks with working code, and the fixes for each.