Writing
Long-form articles on cloud security, AI, and the intersection. Roughly monthly.
Subscribe via RSS →- analysis2026-09-0712 min read
Prompt injection in a voice pipeline: the model scores, but it never decides
I built a scam-call detector on AWS where a caller's own words become input to an LLM. That makes the caller an untrusted author of model input, which is the part most write-ups skip. Here is where the injection surface actually sits, the four things I put in front of it, and why only the last one really matters.
ai-securitycloud-securitythreat-detection - analysis2026-08-078 min read
Per-user encryption keys: a length-extension trap and the HKDF fix
The 'obvious' way to derive per-user encryption keys from a master secret is SHA256(master || user_id). It's wrong in a specific and exploitable way. Here's the attack, and how HKDF fixes it.
cryptographykdfhkdf - migration2026-07-108 min read
How 14 CVEs finally forced my Next.js upgrade (and what the migration actually looked like)
I deferred the Next.js 14 to 15 upgrade for over a year. Then a security audit counted 14 high-severity CVEs sitting in my production next package. Every code change, every build-pipeline gotcha, and the lessons that came out of it.
next-jscves - thesis2026-06-127 min read
Betting on cloud + AI security
The strategic case for specializing in the cloud and AI security intersection. Three legs of the bet, what makes the seam between them actually new, and the under-served third piece nobody is building yet.
cloud-securityai-security - research2026-06-0919 min read
Trends in the Cybersecurity Industry
AI, zero trust architecture, and software supply chain attacks are reshaping modern cyber operations. This paper examines all three and argues that provenance-based build controls should replace the SBOM-centric compliance posture inherited from 2021.
ai-securityzero-trustsupply-chain - incident2026-05-157 min read
A bad week to ship 'next: latest'
Three CVEs, one almost-mistaken major version jump, and a build cache that kept lying to me. Notes from patching dependency vulnerabilities on a brand-new Next.js site within hours of going live.
cloud-securitysupply-chainnext-js