Raise the Floor
You can't finish securing yourself. You can finish finding out.
Rahul Govind·May 30, 2026·9 min read
Security
Blog
What we're working on and what we're thinking about
What happened after we pushed our .env to a public repo
Rahul Govind·July 20, 2026·5 min read
SecurityHoneypotsResearch
Trivial To Introduce, Impossible to Fix: Why SSRFs are the Trickiest Security Issue in Modern Web Apps
One line of code introduces an SSRF. Fixing it correctly requires aligning URL parsing, DNS resolution, redirect handling, HTTP client behavior, and network policy—all at once, without missing a single edge case.
Rahul Govind·February 27, 2026·8 min read
SecurityWeb Security
Sandboxes Won't Save You From OpenClaw
AI agent misbehavior isn't a sandbox problem—it's a permissions problem.
Aakash Japi·February 24, 2026·5 min read
SecurityAI
CVE-2025-14297: MLflow Authorization Bypass
How Tachyon's autonomous security researcher found an authorization bypass in the open-source MLflow tracking server by reasoning across protocols and surfaces—and why this class of bug is so hard to catch.
Aakash Japi·February 3, 2026·10 min read
Security