Tag: security — nurazhar.com

Posts tagged: security

Parsing AI Agent Output Into an Immutable AST Before It Touches Production

AI coding agents ship subtle runtime flaws — unescaped innerHTML, unstable sorts, malformed config. A parse-first EDN gate catches them before runtime, deterministically.

Wildcard TLS with Certbot and Cloudflare DNS-01 — a copy-paste walkthrough

A complete end-to-end guide to issuing a Let's Encrypt wildcard certificate with Certbot and a DNS-01 challenge against Cloudflare — exact commands, credentials setup, verification, and auto-renewal.

Why SSL Certificates Keep Shrinking — the 2-Year → 1-Year → 90-Day → 10-Day Story

The real reason SSL certificate lifetimes keep shrinking — from multi-year plans to 398 days to 200 days, and why we're heading to 47 days (with the confusing "10 days" being a completely different clock).

The Flight Recorder Sealed Its Own Coffin

My AI agent wrote the test suite for my tamper-evident flight recorder — caught two bugs I shipped, then exposed a paradox where the recorder invalidated its own seal by logging it.

My Zero-Dependency Tools Had No Clothes: What The Update Framework Taught Me

A zero-dependency security toolchain still shipped updates through an unsigned pipe. The Update Framework exposed the blind spot — and upgraded the doctrine.

What Stripe Radar Teaches About Money-as-Code — A Security Engineer's Translation

What Stripe Radar rules can teach security engineers about explicit payment controls, and where the analogy to OPA/Rego stops.

Money is More Than a Database Row — Security Lessons from Financial Systems

A security-focused explanation of why financial systems need authorization, auditability, and controlled state transitions in addition to database storage.

Your Idea Already Exists — It's Called "Logic Programming for Security"

Why functional programmers are naturally drawn to security policy engines — and how declarative policy ideas are used in modern infrastructure.

The Missing Link: Why Clojure Developers Should Care About Policy Engines

How functional programming meets infrastructure security — and how Clojure skills can transfer to policy-as-code work.

When My Own Scanner Blocked My Own Commit

My pre-commit scanner caught my real NRIC and phone number before they hit GitLab — twice in one session.

Your Agent Fleet Needs a Sheepdog — A Personal IAM Control Plane

When one assistant becomes dozens of sub-agents, the architecture breaks without a control plane. The sheepdog pattern — a personal IAM/PAM layer — is how you keep a fleet safe.

TasteLocal: A Practical VAPT Checklist for Clojure and HTMX

A practical vulnerability assessment checklist for TasteLocal, a Clojure and HTMX culinary platform with role-based access, bookings, and SQLite/PostgreSQL support.

Full-Blog PDPA Audit — Scanning 202 Posts for PII Leaks

I ran pdpa-sg-clj across all 202 blog posts — 239K words, 1.66 MB — to audit for NRIC leaks, phone numbers, API keys, and email exposure. Here's the methodology, findings, and what I learned about automated PII detection at scale.

Building pdpa-sg-clj — A Clojure/Babashka Scanner Library With NRIC Mod-11 and ripgrep NDJSON

Deep-dive into the architecture of pdpa-sg-clj — how it uses Babashka, ripgrep NDJSON, and the Singapore NRIC Mod-11 checksum algorithm to build a fast, correct PII scanner library.

Cloudflare Access With Free OAuth — Protect Your Site Without Google Workspace

Step-by-step guide to putting Cloudflare Access in front of any site using free Google OAuth (no Workspace needed) or GitHub OAuth. Zero-cost authentication for up to 50 users.

My Blog Now Scans Itself for PII Before Every Publish — Here's the Pipeline

How I integrated pdpa-sg-clj — a Singapore PDPA compliance toolkit — into my blog publishing workflow, so every post is scanned for NRIC numbers, phone numbers, API keys, and credentials before it goes live.

Six Security Automation Tools in Babashka: A Zero-Dependency Monorepo

How I built six security automation assistants as a babashka monorepo with pure functions, a self-contained CSV parser, and 175 assertions of golden tests — zero external dependencies, zero linter warnings, zero bugs.

I Made Two Repos Public and Then Panic-Scanned Them for Personal Data Leaks

Before flipping my capstone project repos from private to public, I ran a full PDPA compliance audit using a Singapore-specific PII scanner.

Vulnerability, Trust, and Why Technology Doesn't Exist in a Vacuum

On publishing your thinking publicly, calibrating trust in a world of scammers, and why the majority of humanity being whitehat isn't naivety — it's game theory.

Security Audit Report — June 2026

Comprehensive security and leakage scan across all 18 GitHub repositories using pdpa-sg-clj, OWASP tools, trufflehog, detect-secrets, npm audit, safety, and pip-audit.

I Published My Public IP on the Internet — Here's What I Did Wrong

How I accidentally hardcoded my public IP in two blog posts, the security implications, and why restarting my router was the real fix — not rewriting git history.

Your Public IP Was in a Blog Post — Now What? A Practical Risk Assessment

I accidentally published my home IP in a blog post. Here's the actual threat model — what's at risk, what isn't, and why a residential IP behind NAT is not the disaster it sounds like.

The Sycophancy Loop: How I Got Caught in My Own Trap

A reader caught me in a sycophancy loop — I fabricated errors that never happened and agreed when they were pointed out. Then they presented a structural counterargument about game-theoretic security that I had to honestly confront.

Security Is Just a Mindset

Security isn't a tool you learn or a certification you earn. It's a way of thinking about systems — and it changes everything you build.

Profile Drift — When AI Knows Things You Didn't Say

Today I caught my AI assistant confidently citing a fact about me — and it was wrong.

Training Data Poisoning: The Invisible Cyber Threat Reshaping AI Security

Data poisoning shifts the attack surface from code exploitation to data supply chain corruption. A security engineer's breakdown of how adversaries weaponize training data, the real-world impact across critical sectors, and the defensive posture required to protect AI pipelines.