Blog

Notes on building secure systems.

Field notes on threat modeling, application security, the software supply chain and regulation — written for the engineers who have to make it work.

• October 13, 2026Your dependencies are part of your architectureMost of the code you ship, you did not write. Treating dependencies and the build pipeline as architecture, not housekeeping, changes what you can defend.2 min read
• October 13, 2026Paved roads beat policiesA policy tells engineers what not to do. A paved road makes the right thing the fastest thing. Only one of them scales.1 min read
• October 13, 2026Reading the Cyber Resilience Act as an engineerThe CRA's reporting obligations now apply. Read through an engineering lens, most of the regulation describes practices good product teams should want anyway.2 min read
• October 13, 2026Threat models that survive contact with engineeringMost threat models die the week after the workshop. The ones that last are small, versioned with the code, and owned by the team that ships it.2 min read