Notes on hiring, security, and how we build Kit.
Define security scanning scope before testing. Check asset ownership, third-party permissions, scanner targets, and who can stop an assessment that goes wrong.
Improve public portal DDoS protection with safe CDN caching, targeted traffic controls, and practical checks that keep private candidate submissions working.
Google paid $1,000 for an exploited Chrome flaw. Learn why technical severity, patch urgency, exploit evidence, and bounty decisions stay separate.
Bill C-26 died, but successor Bill C-8 received royal assent. Learn who Canada's critical cyber law covers, what it requires, and what is not yet in force.
Five incidents show different reporting arrangements, uncertain detection timelines, and the limits of a public vulnerability disclosure channel.
Job scams made candidates distrust real recruiters too. Here's the data, and the trust infrastructure that proves your outreach is legit, not a scam.
Microsoft threatened a researcher with criminal charges, then backtracked in days. Here's how safe harbor in your vulnerability disclosure policy prevents that.
The Mercor breach exposed 4TB of candidate SSNs, passports, and video interviews. Here is why your ATS is a prime target and the privacy-by-design controls that shrink the blast radius.
HackerOne cut Internet Bug Bounty rewards up to 89% on work already done. Here's how to set bug bounty tiers that survive AI slop without betraying researchers.
Displaying items 19-27 of 33 in total