Web security
Writing
2 posts
Guardrails belong at every boundary, not just the front door
Validating user input is the easy quarter of the guardrail problem. The model's own output, what it hands to tools, and what gets rendered afterwards all need the same fail-closed treatment.
Three quiet bugs hiding in a cross-service feature
Shipping a feature across four services meant coordinating an AI backend, a fare search service, and two frontend components. Along the way: a silent configuration bug, a duplicate event contract, and an HTML injection path.