Notes on verification
Short essays on proving exploitability, grading evidence and running security research inside a customer boundary.
- 5 min read
Verification is the bottleneck, not detection
Scanners made findings cheap. The expensive work starts after detection: proving what is exploitable, fixing it without breaking the application, and keeping it fixed.
- 4 min read
Three grades of evidence, and why the labels matter
Execution-confirmed, independently validated, unconfirmed hypothesis. A result is only as useful as the honesty of its label.
- 4 min read
Security research that never leaves your boundary
Regulated teams cannot ship source, build artifacts or identity configuration to a hosted AI service. The research has to come to the code.