Workload Identity Federation Explained (2026): OIDC Instead of Cloud Keys
Workload identity federation explained: why long-lived cloud keys keep leaking (29M secrets on GitHub in 2025), how OIDC token exchange works on AWS, Google Cloud and Azure, Kubernetes projected tokens, SPIFFE, and GitHub's July 2026 immutable subject change.
13 minOct 20, 2026What Is MCP (Model Context Protocol)? A Plain-English Guide for 2026
What the Model Context Protocol is and how it works in 2026: hosts, clients and servers, tools, resources and prompts, stdio and Streamable HTTP, every spec version up to the stateless 2026-07-28 release, Linux Foundation governance, adoption, and the real risks.
12 minOct 20, 2026What Is DevSecOps in 2026? 87% Run Exploitable Code, 4% Pin Actions
DevSecOps explained for 2026: shift-left vs shift-everywhere, what SAST, DAST, SCA, secrets and IaC scanning each catch, SLSA 1.2's new Source Track, and what Datadog, GitGuardian, GitLab, Sonatype and Veracode data say about AI-generated code.
11 minOct 20, 2026Vulnerability Management in 2026: 48,185 CVEs, a Triaged NVD, EPSS v5
Vulnerability management in 2026 explained: 48,185 CVEs in 2025, 67,000+ by September 2026, an NVD that now enriches only KEV and critical software, the CVE funding scare, EPSS v5, CISA KEV at 1,748 entries, VEX and reachability, and a prioritisation order that works.
12 minOct 20, 2026TLS Certificate Lifetimes in 2026: 200 Days Now, 47 Days by 2029
CA/Browser Forum ballot SC-081 cut public TLS certificates to 200 days on 15 March 2026, then 100 days in 2027 and 47 days in 2029. What changed, what Let's Encrypt did (no OCSP, 6-day certs, ACME profiles, 45 days), and how ARI keeps renewals safe.
11 minOct 20, 2026Terraform State in 2026: S3 Locking Replaced DynamoDB, What Else Changed
What Terraform state is and how to run it in 2026: S3 native locking with use_lockfile (GA in 1.11, DynamoDB deprecated), backend choices, HCP Terraform per-resource pricing, OpenTofu state encryption, secrets in state, splitting state and Stacks.
13 minOct 20, 2026How to Self-Host n8n with Docker Compose in Queue Mode (2026)
Step-by-step n8n queue mode setup on Docker Compose: Postgres, Redis, a webhook processor, workers with task runner sidecars, the encryption key, N8N_WEBHOOK_URL, TLS with Caddy, backups, upgrades and patching. Tested on n8n 2.43.8.
16 minOct 20, 2026How to Deploy a Secure Remote MCP Server with OAuth (2026)
Step-by-step: run a remote MCP server over Streamable HTTP as an OAuth 2.1 resource server with Keycloak 26.8.1 and MCP Python SDK 2.3.0, validate audience and scopes per tool, add rate limits and audit logs, deploy to Cloud Run, and fix 401 and discovery errors.
16 minOct 20, 2026Secrets Sprawl 2026: 28.65M Leaked Keys and 64% Still Valid Years Later
What the 2026 secrets sprawl data says: 28.65M new secrets on public GitHub in 2025, AI service keys up 81%, AI-assisted commits leaking at twice the baseline, 24,008 secrets in MCP configs, 10,456 leaky Docker Hub images, and why 64% of old leaks still work.
13 minOct 20, 2026How to Stop Secrets Leaking Into Git: Gitleaks, Pre-commit, CI (2026)
Step-by-step guide to secret scanning in 2026: gitleaks 8.30.1 and TruffleHog 3.99.3 as pre-commit hooks, GitHub push protection, CI scanning with pinned actions, rotating a leaked key, and removing it from history with git filter-repo.
14 minOct 20, 2026Container Runtime Security in 2026: Falco vs Tetragon vs KubeArmor
Kubernetes runtime security in 2026: what Falco 0.45, Tetragon 1.7 and KubeArmor 1.7 actually do, detection versus in-kernel prevention, the runc, NVIDIA toolkit and containerd escape CVEs of 2025 and 2026, and where CNAPP vendors fit.
13 minOct 20, 2026How to Run an AI Coding Agent in GitHub Actions Safely (2026)
Step-by-step hardening for claude-code-action v1.0.254 and codex-action v1.13: SHA pinning, least-privilege permissions, safe triggers, keeping prompt injection from issues away from secrets, tool allowlists, turn caps, rulesets and troubleshooting.
15 minOct 20, 2026How to Defend LLM Apps Against Prompt Injection: 8 Steps (2026)
A practical prompt injection defence guide for LLM apps and agents: break the lethal trifecta, split privileged and quarantined models, gate tool calls in code, sanitise output, add Prompt Guard 2 as a tripwire, and red team with garak 0.17.1 and promptfoo 0.124.1.
17 minOct 20, 2026How to Implement Multi-Tenancy with Postgres Row-Level Security (2026)
Step-by-step Postgres row-level security for multi-tenant SaaS: tenant_id schema design, FORCE RLS and non-owner roles, policies using current_setting, SET LOCAL with PgBouncer transaction pooling, indexes, CI isolation tests and fixes for common errors.
13 minOct 20, 2026OWASP Top 10 for LLMs 2026 and Agentic Apps: 20 Risks, Real Incidents
The OWASP Top 10 for LLM Applications 2026 and the Agentic Top 10 explained risk by risk: what moved since 2025, the real incidents behind each entry (EchoLeak, Amazon Q, postmark-mcp, Replit), and the infrastructure controls that contain them.
13 min