Notes on hiring, security, and how we build Kit.
The Medyc incident shows why medical software vendors need a safe disclosure route and a funded bug bounty before someone exploits a reportable flaw.
Use this AI agent security incident triage guide to preserve probe evidence, verify application access, contain exposure, and contact the right operator.
Use this SSO offboarding checklist to test existing sessions, API tokens, directory delays, and exceptions before accepting a SaaS vendor's access controls.
Close a leaked credential report with evidence: remove exposure, invalidate the old secret, prevent recurrence, and document the limits of your impact review.
Define security scanning scope before testing. Check asset ownership, third-party permissions, scanner targets, and who can stop an assessment that goes wrong.
Improve public portal DDoS protection with safe CDN caching, targeted traffic controls, and practical checks that keep private candidate submissions working.
Google paid $1,000 for an exploited Chrome flaw. Learn why technical severity, patch urgency, exploit evidence, and bounty decisions stay separate.
Bill C-26 died, but successor Bill C-8 received royal assent. Learn who Canada's critical cyber law covers, what it requires, and what is not yet in force.
Five incidents show different reporting arrangements, uncertain detection timelines, and the limits of a public vulnerability disclosure channel.
Displaying items 1-9 of 19 in total