Notes on security, code, and other things I find interesting.

Here you can find some of the things I find interesting and some of the things I've been working on.

Showing 5 posts tagged security

January 18, 202610 min read

Threat Modeling a RAG Pipeline: STRIDE Meets OWASP LLM Top 10

A practical walkthrough of threat modeling a retrieval-augmented generation pipeline — mapping STRIDE threats to OWASP LLM Top 10 risks with controls that actually ship.

security threat-modeling rag llm ai owasp

October 11, 202510 min read

Post-Quantum Cryptography, Eight Years Later: Revisiting My Master's Thesis

In 2018 I wrote a master's thesis on the state of post-quantum cryptography and built simulators for McEliece and Niederreiter. Here's what the field looks like now - and what actually changed.

security post-quantum-cryptography cryptography research

April 12, 20256 min read

People Prefer Organizing Problems Instead of Solving Them

I've had chances to fix real security issues - and been blocked by people who'd rather stay visible than stay safe. Quick wins beat beautiful frameworks.

productivity security thoughts

February 18, 20255 min read

How RCE Works - and How I Found One in IriusRisk's Drools Engine

A technical walkthrough of remote code execution, why rule engines are dangerous attack surfaces, and how a custom Drools rules menu became a Java code injection vector.

security rce vulnerability-research drools

January 28, 20252 min read

Threat Modeling in Practice: From Theory to Production

How structured threat modeling turns security standards into actionable design decisions - without slowing teams down.

security threat-modeling sdlc