security
42 posts
How AWS Dogwood adds temporal conditions to Cedar policies, lowers them back to plain Cedar, and enforces agent guardrails at the Amazon Bedrock AgentCore gateway.
authorization · security · ai-agents +2
Devcontainers, Codespaces and AWS Lambda MicroVMs as homes for a coding agent: what each rung adds, what it costs, and when moving the agent off the laptop pays off.
lambda · claude-code · ai-tools +5
The exact IAM size, attach, and quota limits you will hit at scale, and the scoped-policy, permission-boundary, and SCP structure that keeps you far from every one.
aws · iam · security +2
How high-performing teams keep security review from becoming a lead-time bottleneck: shift-left automation, risk-based gates, a paved road, dependency cadence.
ci-cd · devops · security +3
Bake a single PII branded type into your observability API signatures so TypeScript rejects sensitive fields at the call site, before any runtime redactor sees them.
typescript · zod · observability +3
Production deploys need a real approval gate: use GitHub Environments with native protection rules and scoped secrets, not workflow if: hacks or marketplace actions.
github-actions · ci-cd · devops +2
HMAC-SHA-256 for webhooks, signed URLs, and internal auth, with runnable code in three languages and the boundary where digital signatures take over.
security · encryption · webhooks +4
A hardened, paste-ready setup for adding Anthropic's claude-code-action to a GitHub repo, with the security and cost knobs spelled out for production use.
claude · github-actions · code-review +3
How Zapier MCP gives AI agents action-level whitelisting, credential isolation, and human-in-the-loop approval, a managed alternative to custom scoped proxies.
mcp · security · ai-agents +4
A practical guide to subscription state machines, proration strategies, dunning management, and fraud detection patterns with Stripe webhooks and AWS EventBridge.
subscriptions · payment-systems · security +1
Build SaaS authorization with AWS Cognito and Verified Permissions, covering Cedar policies, multi-tenant patterns, JWT flow, and cost in TypeScript.
authorization · aws · authentication +4
A vendor-neutral evaluation of AWS Verified Permissions, SpiceDB, OpenFGA, Cerbos, and OPA, with architecture patterns, cost analysis, and a decision framework.
authorization · security · architecture +4
A deep comparison of Cedar, Rego, OpenFGA DSL, and Cerbos YAML/CEL policy languages: syntax, performance, formal verification, tooling, and TypeScript integration.
authorization · security · architecture +2
A deep technical comparison of SpiceDB and Auth0 FGA (OpenFGA), two Zanzibar-inspired systems with different trade-offs in schema, consistency, deployment, and scale.
authorization · security · architecture +3
Authentication vs authorization, common permission pitfalls, the fail-closed principle, and the goals every permission system should meet.
typescript · nextjs · authorization +2
Refactor scattered permission checks into a centralized service layer, add Next.js middleware guards, and build a defense-in-depth authorization architecture.
typescript · nextjs · authorization +2
Build a type-safe RBAC system in TypeScript, create a unified can() function, sync permissions across UI and backend, and learn when RBAC reaches its limits.
typescript · nextjs · authorization +2
Build an ABAC policy engine in TypeScript with the builder pattern, conditional permissions, and type-safe policy evaluation that replaces RBAC's limitations.
typescript · nextjs · authorization +2
Extend ABAC with environment-based rules, field-level read and write permissions, and automatic database query filtering that eliminates duplicate permission logic.
typescript · nextjs · authorization +2
Add multi-tenant isolation to your permission system, evaluate CASL as a library alternative, and use decision frameworks to choose the right authorization architecture.
typescript · nextjs · authorization +3
Why production teams replace broad MCP access with scoped API proxies. Atlassian, Google Workspace, and Notion via FastAPI proxy, CLI wrapper, and n8n.
mcp · api-design · python +4
A practical guide to AWS Control Tower multi-account strategy: OU structure, SCPs, RCPs, Account Factory for Terraform, IAM Identity Center, and security.
aws · multi-account · security +3
A practical guide to building an org-level shared GitHub Actions platform: architecture decisions, security governance, adoption, and 7 costly mistakes.
github-actions · ci-cd · devops +5
Enterprise patterns for Model Context Protocol: tool composition, multi-agent orchestration, role-based access control, and production observability.
mcp · ai-adoption-strategy · authorization +4
A technical guide to production-grade prompt engineering: systematic design, security, observability, and cost optimization for enterprise LLM apps.
prompt-engineering · llm · ai-tools +6
A technical guide to advanced Amazon Cognito: custom auth flows, federation, multi-tenancy, migration strategies, and production-grade security with CDK.
aws · authentication · serverless +6
A technical guide comparing AWS Secrets Manager and Parameter Store, showing when to use each service with real-world implementation patterns and CDK examples.
aws · secrets-management · security +7
A practical guide to Mozilla SOPS for encrypting secrets in Git: age encryption, AWS CDK and Lambda patterns, and production-ready serverless security.
secrets-management · ci-cd · terraform +7
Securing AI agents in production with AWS Bedrock Guardrails, defense-in-depth, and patterns that prevent prompt injection, tool misuse, and multi-agent attacks.
ai-agents · aws-bedrock · security +3
Build, secure, and deploy custom Model Context Protocol servers for internal systems in TypeScript, with authentication, monitoring, and Kubernetes deployment.
typescript · mcp · nodejs +5
Implement secure cross-account event distribution with Amazon SNS and SQS: IAM policies, KMS encryption, AWS CDK, and common production pitfalls.
aws · sns · sqs +6
A practical glossary of essential networking concepts for developers - from protocols and DNS to debugging tools and security basics.
networking · http · debugging +3
A practical guide to setting up a secure, affordable private server using VPS, Dokploy for deployments, and Cloudflared tunnels for secure access without exposing ports
docker · deployment · cloudflare +2
A hands-on guide to adopting AI developer tools: readiness scoring, pilot scope, security controls, review capacity, and the metrics worth tracking.
ai-tools · security · code-review +3
Security risks, governance, and trust building for AI developer tools: the 2025 CVEs, shadow AI discovery, and an incident response playbook for leaked secrets.
security · compliance · team-dynamics +1
Definitions, implementation context, and defaults for authentication, token, access control, and Zero Trust terminology that teams argue about.
security · authentication · oauth2 +2
One-size-fits-all auth is a myth: banking, healthcare, e-commerce and SaaS each shape the authentication architecture differently.
authentication · authorization · security +5
Where AI-assisted code review catches what humans miss, where humans still excel, and how to build effective human-AI collaboration in your review process.
code-review · ci-cd · security +7
Implementing custom domains, bulk operations, URL expiration, and defense-in-depth security measures for production link shortener services.
aws-cdk · lambda · security +5
Compare Auth0, Firebase Auth, Supabase Auth, AWS Cognito, and custom JWT: which to default to, how the pricing models differ, and the pitfalls to plan for.
authentication · cloud-providers · security
Auth0 multi-audience authentication across micro frontends: token management strategies and silent authentication in React Native with WebView-based apps.
authentication · oauth2 · react-native +1
Implement robust authentication with Cognito, API Gateway authorizers, and fine-grained IAM policies when migrating from Serverless Framework to AWS CDK.
authorization · aws-cdk · authentication +2