Articles for people who
ship the stack
Rewrites on React, Node.js, TypeScript and AI. A translated body is shown when it exists. If it does not, you see the English text and a note that says so.
Tagged: DevSecOps
Seven Questions to Ask Before Running a Local MCP Server
A checklist for sandboxing local MCP servers, worked through on the GitHub server: short-lived tokens, sealed network, egress allowlist and pinned tool lists.
8 min readHow a One-Character Bearer Token Opened LiteLLM's MCP Gateway
Honeypots caught attackers abusing a LiteLLM MCP auth bypass and a guardrails code-execution flaw. Here is the attack chain and a six-step checklist to harden it.
5 min readPractical notes: Building a Secure Multi-Agent AI Platform on AWS (& What the
Operable walkthrough of Practical notes: Building a Secure Multi-Agent AI Platform on AWS (& What the: contracts, checks, and drop-in code slots for teams shipping this pattern.
8 min readNpm Supply Chain Attacks: How They Work and How to Defend Node.js
Explains how npm supply chain attacks like account takeovers, typosquatting, and dependency confusion work, plus concrete steps to harden Node.js installs.
8 min readWhy DevSecOps Becomes the New Bottleneck in the AI Coding Era
Explains how AI-generated code shifts software engineering's bottleneck from writing code to verifying it, making automated DevSecOps the critical layer of trust.
14 min read
About these articles
Request a 24h estimate
Need the same stack in a production operator layer? Send the brief — estimate within 24 hours.