5 min read
Prompt injection: defenses that work
Chunk-level allowlisting, output filtering, privilege separation for agents. Concrete defenses against retrieved-content injection, not the theory.
#security
4 posts tagged security.
6 min read
Authentication vs authorization
Authentication is a fact you establish once. Authorization is a decision you make on every request — and that gap is where most access-control bugs live.
6 min read
Multi-tenant RAG: relevance is not access control
Vector search ranks by similarity, not permission. Why multi-tenant RAG leaks across tenants by default, and where the authorization check actually has to sit.
7 min read
Next.js 16.3 and the upgrade I stopped deferring
turbopackUseSystemTlsCerts was removed in Next.js 16.2: Turbopack now trusts OS certificates by default. Plus the two 16.3.3 security fixes: patch or migrate?