Research: Security
What an Audit Log Can—and Cannot—Prove
Audit logs record what systems observed. Their value depends on identity, completeness, time and integrity.
Secret Rotation Without Breaking Connected Services
How to rotate service secrets across applications with a controlled handoff, short overlap, testing and revocation.
Account Recovery Flows That Protect Ownership
A practical recovery design for lost authenticators, compromised sessions, recovery codes and safe notifications.
Audit Log Retention: What to Record and Protect
A useful audit log names the actor, action, target, time and outcome without becoming a second secrets database.
1Password Gives Claude a Login Without the Password
A new integration separates permission to use a credential from exposing the secret to an assistant.
The React Server Components Bug Exposes a Blind Spot
The December disclosure makes one question urgent: which server packages are actually running in your application?