Notes on hiring, security, and how we build Kit.
Verify credential rotation after Railway's incident: revoke old access, apply replacement settings, and check the workflows that depend on each secret.
Test passkey recovery before enforcing it: rehearse lost devices, unavailable backups, administrator approval, and the sessions that stay signed in.
Zod's repository held malicious code, but no infected Zod package reached npm. Use four evidence checks to separate source compromise from release exposure.
Domain hijack recovery needs more than restored DNS. Find unauthorized TLS certificates, request revocation, review CAA and document what remains unverified.
Fakturownia's breach shows why invoice platforms need a clear path for vulnerability reports and rewards for verified, high-impact findings.
The Medyc incident shows why medical software vendors need a safe disclosure route and a funded bug bounty before someone exploits a reportable flaw.
Use this AI agent security incident triage guide to preserve probe evidence, verify application access, contain exposure, and contact the right operator.
Use this SSO offboarding checklist to test existing sessions, API tokens, directory delays, and exceptions before accepting a SaaS vendor's access controls.
Close a leaked credential report with evidence: remove exposure, invalidate the old secret, prevent recurrence, and document the limits of your impact review.
Displaying items 10-18 of 33 in total