Featured
What I look for first when I open a production system
Five days inside a system I have never seen. The checks are familiar. The judgment is what to inspect first, what to leave unread, and why.
Read →Writing
Field notes
On production reliability, audits, and what it takes to ship AI into regulated domains.
-
From LinkedIn · · illustrated · 1 min
The boundary is what all of them say at once
Nobody opens a pull request called Widen tenant access. They open three reasonable ones instead, each gets its own policy, and PostgreSQL combines permissive policies with OR.
-
From LinkedIn · · 1 min
Two files are not two sources of evidence
AI can write the code and the tests from the same prompt. That produces two files. Independence comes from a source that can disagree with the implementation.
-
From LinkedIn · · 1 min
Human in the loop is a box on a diagram
The log shows an approval. It doesn't prove a decision was made. A real control leaves evidence of disagreement, and most of them never have.
-
From LinkedIn · · 1 min
Permissions look like settings
Permissions don't look like decisions when you make them. They look like settings. What the next owner inherits is every grant, and almost none of the reasons behind it.
-
From LinkedIn · · 1 min
The sixth category
Five categories had nowhere to file the same recurring risk. The sixth asks a different question: can the company transfer what it says it owns, and what makes it worth owning once it does?
-
From LinkedIn · · 1 min
What buyers see that founders don't
The code transfers at a sale. The reasons don't. What a founder experiences as knowing their system, a buyer prices as risk.
-
From LinkedIn · · 8 slides · 2 min
5 signs your production system needs an audit
An audit is not for a system that is broken. It is for a system that still works, for reasons nobody can fully state. Five signs you have crossed that line.
-
From LinkedIn · · 1 min
An audit is not a bug hunt
Most serious production risk is not a broken thing. It is a permission someone granted years ago and nobody revisited. An audit maps trust, not bugs.
-
From LinkedIn · · 1 min
Later is me
What 'we'll add tests later' actually means once 'later' arrives. Tests are not a code-quality bonus. They are the only honest proof that a system behaves the way the team thinks it behaves.
-
From LinkedIn · · illustrated · 2 min
Anatomy of a P0
Most production outages are boring. They hide in the part of the system nobody looks at because it has always just worked. The anatomy of one.
-
Field note · · 1 min
The backup you have never restored is not a backup
A backup nobody has restored is a hypothesis. Until the restore runs against a clock, you do not have a recovery plan. You have a setting.
-
Field note · · 1 min
Temporary admin credentials are permanent
The access that was widened once for a deploy and never narrowed is the access an attacker eventually finds. Temporary is the most expensive word in an auth model.
-
Field note · · 1 min
Most SaaS auth fails after login, not at it
Teams pour effort into proving who you are. The breach is almost always in what you are allowed to do once you are in. Authentication is the door. Authorization is the building.
-
From LinkedIn · · 1 min
3 patterns I find in 80% of early-stage backends
Most early-stage backends break in the same three places, and they stay invisible until something goes wrong: credentials in git, auth by accident, and backups nobody has restored.
-
From LinkedIn · · 1 min
What does 'something you can rely on' actually mean?
'We have something we can rely on' sounds clean. It is also vague. The five things that have to be true before a system earns the word reliable.
-
From LinkedIn · · 10 slides · 1 min
From audit to pause: when stopping is the right call
I was brought in to audit a system that had been 'in development' for nine months. In five days we mapped it, found the risks, and the right call was to stop.