Blog
Notes on building automated discovery that can't overstep its bounds — method, safety engineering, and what I'm learning.
- The audit log as evidence 2026-10-19 · 10 min
- Measuring railed discovery: metrics against fixtures, not hope 2026-10-19 · 10 min
- Scope encoding: allowlists the gate owns 2026-10-18 · 9 min
- Authorization as a type, not a checkbox 2026-10-17 · 9 min
- Building a reproducible vuln lab you actually trust 2026-10-17 · 8 min
- Safety rails, not safety warnings: why responsible automation has to be architectural 2026-10-15 · 7 min
- The cost of being safe: measuring the trade-off in automated vulnerability discovery 2026-10-15 · 6 min
New posts roughly every two weeks, following the thesis. Want to be notified? Say hi — a mailing list is coming.