Engineering notes

Full-disk encryption protects a powered-off laptop and nothing else. Here's the three-layer model — disk, file, pre-upload cloud — and which tools bel

A consultation-records API was accessed abnormally and exposed 219,665 users. No exploit, no stolen credentials — just an endpoint answering more ques

Meta's Muse asks for email, calendars, payments and health data. Agents are not apps — they hold standing access and act without you. Here are the six

CloudSEK read a phishing operation's own admin panel. 461 orgs, 1,032 plaintext passwords, and 474 sessions where MFA was fully satisfied and still by

A 32.8M record database hit a Russian forum at $15,000 with no passwords in it. Here are the four consistency tests that separate a real breach sample

Microsoft has been investigating live intrusions against exactly the stack a lot of us self-host: an...

Unit 42 documented agents chaining 50+ MITRE techniques to root access in under 10 hours. No zero-days — just automation speed. What it changes for sm

15,000 posts, no exploit involved, disclosed months late. What the DseWiki agent incident means for anyone deploying agents — and the control most tea

Two weeks of AI-search groundwork produced exactly zero citations — and one measurement bug that nearly made me report a false zero.

I wrote a script to catch claims I can't back up. The first real bug was it flagging the sentence where I said I didn't test anything.

My site checker reported zero failures. Google Search Console disagreed — and Google was right.

Ten clicks, zero accepted, one confusing quota error — and the cause had nothing to do with the script.

I assumed GSC's request-indexing had to be manual. One afternoon proved me wrong.

Search Console exports contain a lot of noise. Here's how to tell keywords from log entries.

Search Console said pages weren't indexed. They were fine — they'd never been submitted at all.

Why impressions without clicks is a ranking problem, not a content problem.

Search Console warnings describe symptoms, not causes. Here is how testing all 435 URLs found the real problem.

Filtering internal links by rank band and topical overlap — plus the three that keyword matching got wrong.

Automated checks validate content and structured data. They don't tell you whether the page renders. Here's what I was missing.

Real numbers from launching five niche comparison sites: 69k impressions, 5 clicks, and what I changed after reading the data.

Google doesn't read your articles. It fingerprints them. Earlier this year, a batch of comparison...

Here's a number that hurt: 50,000 Google impressions over three months, seven clicks total. That was...

Here's a paradox that took me three months and a lot of staring at Google Search Console to...

Effective-dated records, ambiguous identity and imported derived values are what actually break HRIS migrations — not the API.

Valid HTML, no errors, nothing worked. How three undefined classes broke a redesign.

An LLM API key is a bearer token with a credit card attached. The audit, the leak paths, and why rotation order matters.

Funding news is usually noise for software buyers. This one isn't. HiBob raised $166M led by...

Every PM tool ticks every feature box. Here is what actually breaks a rollout: seat-count cliffs, migration cost, permission rigidity, and who reads t

xAI's Haggle Bot claims $100K in first-week savings. The number is theirs, at their scale. But the checks it runs are the same four that show up in al

OpenAI just published the most useful public data I've seen on what AI agents actually...

I Ran My Business on $0 AI Tools for 4 Months I assumed running a business with AI tools...

The Problem: Video Production Takes Too Long Making videos used to take me 13 hours per...

The Tool Everyone Misses Everyone recommends Jasper. But Claude is the tool I keep...

Gated vs ungated affiliate programs — and why waiting on network approval cost me weeks.