The blog
Writing about security, software development, and AI tools.
I'm a security engineer, and this blog is an ongoing experiment with LLMs: taking them as far as they can go in security work, in code, and in writing, and sharing what I find along the way.
2026
Quoting Venkatesh Rao: LLM Voice
In defense of the stylistic quirks of LLM writing
Do Agent Skills Matter?
Skills are bets, not infrastructure: where agent skills genuinely help (alpha, glue, local models) and where they just pollute the context.
Quoting Daniel Stenberg: Ignore the Slop
Real vulnerabilities found by AI still need fixing, even when the report arrives wrapped in slop.
Someone Still Has to Read It
Unedited LLM prose saves the writer time by spending the reader’s attention. sloppy-syntax is a small CLI for flagging familiar patterns during writing and review.
Save Your Tokens for Judgment Calls
If code can do it, don’t burn tokens on it. Save the LLM for the parts that actually need judgment.
Solana Vulnerabilities That Aren’t
A few bug classes that auditors keep reporting, but which don’t actually exist.
2025
Getting Roasted by my LLM Style Editor
My own style-editing agent delivered unexpectedly harsh feedback. It stung, and it was exactly what I needed.
Stop Running npm install
The sha1-hulud attack compromised 830 packages and leaked 11,000 secrets. MFA stops account takeovers. npm ci stops propagation.
Slop In A Bucket
LLM-generated code, linters, and the security problems we can and can’t solve.
Sloppy Syntax
A personal collection of totally radioactive syntax often generated by LLMs.
Security is PvPvE
Security work isn’t just about outsmarting attackers. You’re also fighting the computers themselves.
Bernoulli Coding
The middle ground in software development is dead. I now write code in just two modes: fortress-grade security or complete disposable chaos.
Slopsquatting detection added to Scary Strings
Preventing AIs from installing sketchy packages
Browser Use is Solving the Wrong Problem
The browser has been the everything app for a long time, and much hype surrounds the idea of automating browser use with LLMs. But in the age of AI agents, …