Blog
Keep updating with our latest articles
Insights on building AI-native products, shipping fast, and scaling startups with intelligence built in from day one.
GitHub Actions lockfiles make dependency drift reviewable
GitHub's new workflow lockfile pins actions to reviewed commits, records repository identity and covers transitive action dependencies. The control works only if teams treat lockfile changes as security-sensitive code.
A valid webhook signature does not stop a replay
HMAC proves that a webhook payload came from someone who knows the secret. Preventing duplicate charges, emails and access grants also requires a freshness check, an atomic event ledger and idempotent business logic.
A pull request should not be able to publish your package
A safe release path separates untrusted pull-request tests from the workflow that can publish. Use short-lived credentials, narrow permissions and a second release gate.
The EU's 24-hour reporting clock now covers software you already shipped
CRA reporting duties started on 11 September 2026. Understand the evidence that starts the clock, the live reporting platform and the limits of the rule.
Introducing QuantaKrypto: Our New Post-Quantum Cryptography Division
We're launching QuantaKrypto, a dedicated post-quantum cryptography (PQC) practice — audits, open-source tooling, training, and research to get your organization quantum-ready before Q-day. Here's why it matters now, and what PQC actually means.
The Autopilot Trap: Why AI-Generated Code Fails Security Review
AI writes most of the code now — and nobody reads it. It compiles, the demo works, it ships. Then it fails the security review, or worse, it leaks. Here are the failure patterns we see over and over, and how we fix them.
Subscribe to our newsletter to receive research and other information about the industry and what we do.