Articles
Practical writing for CISOs, engineering managers, and security teams evaluating how to govern AI coding tools at scale.
A critical symlink-following flaw in six major AI coding assistants — including Cursor, Claude Code, and Amazon Q — shows why 'human in the loop' is not a security boundary.
A technical tutorial on routing Claude Code, Codex CLI, and other AI coding agents through a local proxy so teams can inspect model traffic, enforce policy, and build an audit trail.
A technical walkthrough of allow/deny/ask rules, PreToolUse hooks, approval accumulation, and why local permission files are not organizational policy.
A deep technical look at how Claude Code, Codex CLI, and other coding assistants manage sessions, enforce permissions, and store state locally — and where the governance model breaks down.