Deep dives into security research, supply chain risks, systems programming, and building software that holds up under pressure.
4 articles
The on-time window for Y Combinator Fall 2026 closed July 27 — late apps are still open. Here's the timeline, how to think about the application, and the parallel programs worth submitting to: 500 Global, a16z Speedrun, Techstars, Sequoia Arc, and more.
How 2,180 Developers Got Hacked By Their Own AI Assistants (And 40% Still Haven't Fixed It).
After analyzing s1ngularity, Shai-Hulud, and Qix attacks, I've adopted a paranoid approach to dependencies. Trust nothing, verify everything, even that innocent-looking npm package.
Why traditional vulnerability scanning fails against modern supply chain attacks and how zero trust principles are reshaping open source security.