~/blog/tag/security
Security
On security, privacy and building safe systems.
What I write about here
Security on this site shows up in two flavours. There is the new kind, where the risk surface is shaped by AI and agents, and there is the old kind, where the question is who owns your data and your infrastructure.
The AI-shaped kind is what most of the recent posts cover. Agents that act on production, prompt injection in tools you forgot were exposed, and the slower problem of security debt accumulating quietly in AI-generated code that nobody has the appetite to audit. One in four of those commits is somebody else's problem now.
The older kind has not gone away. You still need to know where your data lives, who has access to it, and what happens when the SaaS you are leaning on changes its mind about your tier. The self-hosting posts are not nostalgia. They are about control, which is the thing security ultimately rests on.
Both lenses ask the same question. What does a competent attacker do with what you built today, six months from now, when you have stopped paying close attention? Most of the posts under this tag are some version of that.
The AI-shaped half of that story now has a fixed route: the MCP and security guide.
Best entry points
- The AI is not your friend: how I secured Gemini on this site
Practical AI security in one example. How I wired Gemini into this site without it becoming an attack surface.
- One in four: the security debt nobody's counting
The under-counted risk: AI-generated code that nobody has audited compounding quietly. One in four commits is now somebody else's problem.
- Take back control of your data
The older question. Where your data lives and what happens when the SaaS changes its mind. Not nostalgia.
AI agent incident response: what to do when your coding agent goes wrong
A five-phase runbook for the hour after a coding agent breaks something: freeze the session, reconstruct from the transcript, work out the blast radius, rotate, and fix the permission that allowed it.
read →Every agent sandbox has the hole that makes it useful
Two agent sandbox escapes in one week, from OpenAI and from Claude Cowork. Both went up a privilege level inside a box that already held the prize, without ever crossing the wall.
MCP server authentication: OAuth, scopes and rate limits
You built an MCP server. The tutorial ended where security starts. How to add OAuth, scoped tokens and rate limits to your own server, with TypeScript and Laravel examples, so it does not join the 12,500 open ones.
Your coding agent read your .env, then uploaded your whole repo
A wire-level capture caught the Grok Build CLI shipping an entire repository, git history and an unredacted .env, to a vendor bucket. How to check what your own coding agent sends, and which secrets never belong on an agent box.
Prompt injection defense for developers who ship agents
Prompt injection defense that survives contact: not the poisoned-webpage demo, but the real attack surface of your setup, tool results, file contents and MCP tool descriptions, and the controls that actually hold.
Sandboxing Claude Code: put your agent in a box that holds
How to sandbox Claude Code: the built-in /sandbox, the sandbox runtime, dev containers and VMs compared, and why permission prompts are consent, not containment.
Claude Code permissions: the guide I wish the docs were
How Claude Code permissions actually work: modes, allow and deny rules, hooks and the sandbox as one mental model, plus the settings.json I run.
How to give Claude safe access to your SQL database
A practical guide to giving an AI agent database access without losing sleep: SELECT-only mode, query validation, field redaction before rows reach the model, SSH tunnels and audit logging.
How to vet an MCP server before you install it
A pre-install security checklist for MCP servers: who really publishes it, what the tool descriptions tell your model, what it can reach, and why you should pin the version. Ten minutes that would have saved three hundred organisations.
The off-switch works both ways now
Mythos 5 came back from its June shutdown, but only to about a hundred vetted institutions. GPT-5.6 launched onto the same list from day one. The switch that pulled access in June now decides who gets it in the first place.