Writing
On production reliability, audits, and what it takes to ship AI into regulated domains.
Featured · 10 slides
I have five days, not to fix a system, but to find where it will fail and what that failure will cost. The order I look in is not a checklist. It is a ranking by blast radius.
Read →From LinkedIn · · 8 slides · 2 min
An audit is not for a system that is broken. It is for a system that still works, for reasons nobody can fully state. Five signs you have crossed that line.
From LinkedIn · · 1 min
Most serious production risk is not a broken thing. It is a permission someone granted years ago and nobody revisited. An audit maps trust, not bugs.
From LinkedIn · · 1 min
What 'we'll add tests later' actually means once 'later' arrives. Tests are not a code-quality bonus. They are the only honest proof that a system behaves the way the team thinks it behaves.
From LinkedIn · · illustrated · 2 min
Most production outages are boring. They hide in the part of the system nobody looks at because it has always just worked. The anatomy of one.
Field note · · 1 min
A backup nobody has restored is a hypothesis. Until the restore runs against a clock, you do not have a recovery plan. You have a setting.
Field note · · 1 min
The access that was widened once for a deploy and never narrowed is the access an attacker eventually finds. Temporary is the most expensive word in an auth model.
Field note · · 1 min
Teams pour effort into proving who you are. The breach is almost always in what you are allowed to do once you are in. Authentication is the door. Authorization is the building.
From LinkedIn · · 1 min
Most early-stage backends break in the same three places, and they stay invisible until something goes wrong: credentials in git, auth by accident, and backups nobody has restored.
From LinkedIn · · 1 min
'We have something we can rely on' sounds clean. It is also vague. The five things that have to be true before a system earns the word reliable.
From LinkedIn · · 10 slides · 1 min
I was brought in to audit a system that had been 'in development' for nine months. In five days we mapped it, found the risks, and the right call was to stop.