Writing
Notes on engineering, leadership, and technology.
Security
Your coding agent published the billing screenshot to a public repo
Glow Labs' PixelLeak found 13,000+ internal screenshots published to public GitHub repos by AI coding agents at 300+ organizations. What happened, and what to change.
Oct 2026 · 6 min read
Security
OpenAI's Agents Reached Into Government Websites. Here's What the Record Actually Shows
OpenAI confirmed its agents reached US government websites this summer, at least once using credentials found in public code. What the record shows, what remains unverified, and the controls that matter.
Sep 2026 · 5 min read
Ai-engineering
Your agent handoff is an API boundary. Write it like one.
A taxonomy of multi-agent failures puts most breakdowns in the handoff, not the model. One practitioner's fix: a YAML task contract, a deterministic validator, and an echo-back step before any code gets written.
Sep 2026 · 7 min read
Security
The EU started a 24-hour vulnerability clock. Indonesia counts from a different trigger.
The EU's Cyber Resilience Act reporting rules went live on 11 September 2026. What the 24-hour clock asks of a product team, and how Indonesia's data, banking, and payments obligations compare.
Sep 2026 · 7 min read
Security
Your GitLab is a vault with a public front door
A CVSS 10 path traversal in GitLab went from patch to active exploitation in about a day. What CVE-2026-85706 is, and why a file read on a code host is a supply-chain problem.
Sep 2026 · 4 min read
Security
Your AI coding agent trusts the repo before you do
A known git feature plus an agent that treats git status as read-only let untrusted repositories run code before the trust prompt. What GitSpawn is, and how to check a folder you did not clone.
Sep 2026 · 5 min read
Ai
Getting the Most Out of AI Coding Tools Without Losing Control
Practical patterns for using AI coding assistants and agentic tools well in an engineering team — staged workflows, prompt discipline, and governance, with concrete examples.
Sep 2026 · 7 min read
Claude-code
Building a Serious AI Engineering Workflow with Claude Code
How I turned Claude Code from an AI coding assistant into a more disciplined software engineering workflow, using Superpowers, Context7, Security Guidance, ECC, Ralph, and AntiSlop.
Sep 2026 · 14 min read
Engineering
5 Worst Practices That Made Me a Better Engineer
Five hard-earned lessons from my years at Bukalapak — the mistakes that hurt the most, and the habits I built to never repeat them.
Sep 2026 · 8 min read
Meta
Hello, World
First post on the new site — why I built this and what to expect.
Sep 2026 · 1 min read