Most malicious package releases are caught within hours. A one-day waiting period before installing anything new costs almost nothing and sidesteps a whole class of supply-chain attacks. Here's how I set it up, and where the exceptions go.
Security · Infrastructure · Next.js6 min read
Two rules sit at the center of a governance runtime I've been building: when in doubt, the answer is no, and the record is written before anything happens. Here's what they mean in practice, and why they matter more as agents start taking real actions.
Architecture · Security · Agents7 min read
In the healthcare platform I'm building, patient data lives in its own database and nothing else does. That one rule shapes auth, sync, queries and how I think about risk.
Healthcare · Architecture · Security · Data6 min read