https://khaganaydin.com/writing/Essays on security, AI and how decisions are made.enhttps://khaganaydin.com/writing/how-hackers-took-6-billion-from-binance-without-a-key/https://khaganaydin.com/writing/how-hackers-took-6-billion-from-binance-without-a-key/Fri, 30 Oct 2026 12:00:00 GMTThe largest crypto theft in history did not start with a stolen key. It started with one engineer's laptop and ended with Binance's own systems signing the attacker's withdrawals. What happened, and the lesson under it.https://khaganaydin.com/writing/your-github-is-a-vault-not-a-graveyard/https://khaganaydin.com/writing/your-github-is-a-vault-not-a-graveyard/Fri, 30 Oct 2026 12:00:00 GMTYour GitHub holds your code, your pipeline and your keys. Most people run it like a junk drawer: forgotten integrations, zombie tokens, and bots opening pull requests nobody reads. How the graveyard gets you breached, and the old rule for handing over a key.https://khaganaydin.com/writing/i-asked-an-ai-which-suv-to-buy/https://khaganaydin.com/writing/i-asked-an-ai-which-suv-to-buy/Sun, 11 Oct 2026 12:00:00 GMTWhat security taught me about trusting an answer, and the decision framework I built Argumont on.https://khaganaydin.com/writing/how-to-build-a-robot-from-zero/https://khaganaydin.com/writing/how-to-build-a-robot-from-zero/Sun, 20 Sep 2026 12:00:00 GMTYou do not need AI or humanoids to start. A plain-language guide to the parts of a simple robot: body, motors, drivers, controllers, power and sensors.https://khaganaydin.com/writing/hidden-risks-of-offshoring-cybersecurity/https://khaganaydin.com/writing/hidden-risks-of-offshoring-cybersecurity/Fri, 11 Apr 2025 12:00:00 GMTWhy outsourcing security might cost you more than it saves: culture gaps, access, local law, and the real breaches that went through outside teams.https://khaganaydin.com/writing/the-php-bug-that-gave-away-windows-servers/https://khaganaydin.com/writing/the-php-bug-that-gave-away-windows-servers/Tue, 11 Jun 2024 12:00:00 GMTCVE-2024-4577 let anyone run code on a Windows PHP server with one web request. How a single hidden character revived a twelve-year-old bug, how attackers used it, and how to close it.https://khaganaydin.com/writing/understanding-and-implementing-fedramp/https://khaganaydin.com/writing/understanding-and-implementing-fedramp/Sat, 17 Feb 2024 12:00:00 GMTFedRAMP is how a federal agency reuses someone else's security review instead of doing its own. What it really is, the parts that carry the weight, the honest cost, and a worked example.https://khaganaydin.com/writing/model-theft/https://khaganaydin.com/writing/model-theft/Wed, 27 Dec 2023 12:00:00 GMTIf you trained or tuned your own model, the file is a valuable asset, and so is the behavior visible through your API. How attackers steal the weights outright or copy the model by querying it, and how to protect both.https://khaganaydin.com/writing/excessive-agency/https://khaganaydin.com/writing/excessive-agency/Mon, 18 Dec 2023 12:00:00 GMTThe more a model can do on its own, send mail, move money, change records, delete data, the more a single trick or confident mistake turns into real damage. Why least power beats more power, and where to put a human.https://khaganaydin.com/writing/insecure-plugin-design/https://khaganaydin.com/writing/insecure-plugin-design/Mon, 11 Dec 2023 12:00:00 GMTPlugins and tools are the model's hands. They let it fetch a page, run a search, call a service. But the inputs come from the model, which means they can come from whoever injected the model. How to build tools that cannot be turned against you.https://khaganaydin.com/writing/llm-supply-chain-security/https://khaganaydin.com/writing/llm-supply-chain-security/Mon, 04 Dec 2023 12:00:00 GMTThe models, datasets and libraries you pull in are dependencies like any other, but with far less mature tooling to check them. How a poisoned package or a tampered model walks in through a normal install, and how to close the door.https://khaganaydin.com/writing/model-denial-of-service/https://khaganaydin.com/writing/model-denial-of-service/Mon, 27 Nov 2023 12:00:00 GMTLanguage models are slow and priced by the text they process, so a few shaped requests can burn your capacity or your budget. The attack needs no exploit, just expensive work, and the caps that stop it.https://khaganaydin.com/writing/training-data-poisoning/https://khaganaydin.com/writing/training-data-poisoning/Mon, 20 Nov 2023 12:00:00 GMTIf you train or fine-tune a model, whoever controls part of the data controls part of the model. How a few poisoned records plant a hidden backdoor, a real proof of concept, and what to actually check.https://khaganaydin.com/writing/insecure-output-handling/https://khaganaydin.com/writing/insecure-output-handling/Mon, 13 Nov 2023 12:00:00 GMTTeams validate what goes into a language model and forget what comes out. But the output is just more untrusted text, and if it flows into a page, a query or a shell, it can carry an attack. The trap and the fix.https://khaganaydin.com/writing/the-owasp-top-10-for-llm-applications-explained/https://khaganaydin.com/writing/the-owasp-top-10-for-llm-applications-explained/Mon, 06 Nov 2023 12:00:00 GMTOWASP published its first list of the ten biggest security risks in software built on large language models. Here is what each risk means, a real example of each, and the one defense that matters most.https://khaganaydin.com/writing/how-transformers-work/https://khaganaydin.com/writing/how-transformers-work/Mon, 16 Oct 2023 12:00:00 GMTEvery major language model is built on the Transformer, a design first published in 2017. What it does step by step, a working attention example in Python, and what the design means for the people building on it.https://khaganaydin.com/writing/securing-an-llm-application-checklist/https://khaganaydin.com/writing/securing-an-llm-application-checklist/Mon, 18 Sep 2023 12:00:00 GMTThe new OWASP Top 10 for Large Language Model Applications, turned into concrete checks and code a development team can apply before release.https://khaganaydin.com/writing/why-language-models-make-things-up/https://khaganaydin.com/writing/why-language-models-make-things-up/Mon, 10 Jul 2023 12:00:00 GMTA fluent answer is not a verified answer. Why language models invent facts, where they do it most, and a checking routine with code that rejects unsupported answers.https://khaganaydin.com/writing/gas-limiting-vulnerability-in-web3/https://khaganaydin.com/writing/gas-limiting-vulnerability-in-web3/Sat, 01 Jul 2023 12:00:00 GMTOn a blockchain the cost of running your code is attacker-controllable, and an unbounded loop can freeze a contract for everyone. The vulnerable pattern, the fix, and why it is permanent.https://khaganaydin.com/writing/before-you-paste-company-data-into-an-ai-chatbot/https://khaganaydin.com/writing/before-you-paste-company-data-into-an-ai-chatbot/Mon, 15 May 2023 12:00:00 GMTWhat happens to the text you type into ChatGPT and similar tools, what has already gone wrong this spring, and a one-page policy a team can adopt this week.https://khaganaydin.com/writing/threat-modeling-medical-iot-devices/https://khaganaydin.com/writing/threat-modeling-medical-iot-devices/Thu, 27 Apr 2023 12:00:00 GMTIn a medical device the worst case is not a data breach, it is a patient harmed by a wrong dose. A worked threat model of a diabetes tool, and why the ranking has to put safety first.https://khaganaydin.com/writing/improper-input-validation/https://khaganaydin.com/writing/improper-input-validation/Thu, 13 Apr 2023 12:00:00 GMTImproper input validation is the root under most injection bugs. What counts as input, why blocklists lose, and how to check it on the server, with code.https://khaganaydin.com/writing/dont-hide-vulnerabilities-behind-a-firewall/https://khaganaydin.com/writing/dont-hide-vulnerabilities-behind-a-firewall/Wed, 12 Apr 2023 12:00:00 GMTA firewall filters traffic. It does not fix broken code. A story from a client who chose the firewall, what it hid, and the one question that tells a fix from a cover-up.https://khaganaydin.com/writing/how-to-build-an-application-security-program/https://khaganaydin.com/writing/how-to-build-an-application-security-program/Wed, 12 Apr 2023 12:00:00 GMTYou are the first security hire. Before any tool, your job is to see what exists and who owns it. A playbook from inventory and threat modeling to SAST, DAST in your pipeline, and making security the default.https://khaganaydin.com/writing/what-is-idor/https://khaganaydin.com/writing/what-is-idor/Wed, 12 Apr 2023 12:00:00 GMTIDOR is when an app trusts you to ask only for your own data. How it happens, a real exposure of 885 million records, and the one check that closes it, with code.https://khaganaydin.com/writing/what-is-threat-modeling/https://khaganaydin.com/writing/what-is-threat-modeling/Tue, 11 Apr 2023 12:00:00 GMTThreat modeling is four plain questions you ask before you build, not after. A worked example on a food delivery app entering a new city, with STRIDE and an honest take on scoring.https://khaganaydin.com/writing/prompt-injection-when-the-data-gives-the-orders/https://khaganaydin.com/writing/prompt-injection-when-the-data-gives-the-orders/Mon, 20 Mar 2023 12:00:00 GMTLanguage models cannot tell your instructions from the text they read. How prompt injection works, real cases from the last six months, vulnerable and safer code, and the defenses that hold up.https://khaganaydin.com/writing/how-to-write-prompts-that-get-reliable-answers/https://khaganaydin.com/writing/how-to-write-prompts-that-get-reliable-answers/Wed, 14 Dec 2022 12:00:00 GMTA language model answers the question you typed, not the one you meant. Seven habits, with examples and a test harness, that make ChatGPT and similar tools give answers you can use.https://khaganaydin.com/writing/http-parameter-pollution-in-practice/https://khaganaydin.com/writing/http-parameter-pollution-in-practice/Tue, 12 Jun 2018 12:00:00 GMTWhat happens when a request sends the same parameter twice, how PHP, Java, Python, Node.js and others disagree, four attacks with working code, and the fixes for each.