1290 posts · Page 39 of 108. ← Blog
The series finale — where LLM reviewers genuinely help on every pull request, where they quietly fail, and how to build a human-plus-AI workflow that speeds review up without letting judgment or accountability leak away.
The capstone: using AI/LLM reviewers well and where humans stay essential — AI as a tireless first pass that clears the noise, its limits (design judgment, contextual security, accountability, hallucinations), and a healthy human+AI division of labor.
The DevSecOps series finale — shifting right to runtime, turning compliance into code, closing the incident feedback loop, measuring what matters, and the culture that makes secure the default path.
The capstone: shifting right to continuous security — runtime detection and vulnerability management as a loop, security observability and tamper-evident audit, compliance-as-code with evidence from the pipeline, metrics that matter, and the culture (paved roads, champions).
The finale of the API Security series — how to bake security into the way APIs are designed, built, tested, shipped, and operated, so that every control from the previous seven posts becomes a repeatable part of the pipeline instead of a one-time heroic effort.
The capstone: baking security into the API lifecycle — shift-left threat modeling, CI gates (SAST, SCA, secret scanning, spec-driven authz/BOLA and DAST tests that fail the build), an OWASP-API-Top-10-to-control map, and incident response.
How APIs are designed, shipped, and kept consistent at scale — the design review, the enforceable style guide, spec linting as policy-as-code, contract tests, an API catalog, and the org model that makes ten teams' APIs feel like one.
The capstone: designing and shipping consistent APIs at scale — the lifecycle, design review and style guides, linting the spec as policy-as-code in CI, contract testing so changes don't break consumers, an API catalog with ownership, and production observability.
The capstone — one problem, a home-timeline feed, designed the whole way through with the method from post one: clarify, estimate, contract, then high-level to deep-dive to bottleneck, naming the trade-off at every step and drawing on all seven earlier posts.
The capstone: one worked design end to end — requirements, estimation, API and data model, high-level architecture, and deep dives applying the whole series (scaling, caching, sharding, consistency, async, reliability) with explicit trade-offs.
The series finale: how to proactively find AI security failures before attackers do — turning injection, leakage, and excessive-agency risks into a repeatable adversarial test suite that runs in CI, measuring attack success honestly, and standing up incident response for the day a control fails.
Find AI security failures before attackers do: adversarial testing of the whole system, a test taxonomy mapped to the series, automated tooling (PyRIT, garak), a CI security-regression suite that fails the build, honest attack-success-rate measurement, and AI incident response.
Finding the documents that contain your words is the easy part; putting the best one first is where search lives or dies. For decades, the answer to "how relevant is this document to this query?" has come from two intuitions made precise: a word matters more in a document that uses it often, and matters less if it's common across all documents. TF-IDF and BM25 turn those intuitions into the scoring functions that rank most of the world's text search — and understanding them demystifies why search returns what it does.
Finding matches is easy; putting the best first is where search lives. Two intuitions — a word matters more when frequent in a document, less when common across all — become TF-IDF and then BM25, the decades-long default (and the keyword score in hybrid RAG). Its lexical ceiling is the vocabulary gap.
Building something with an LLM is easy for a weekend and hard for a year. The wall almost everyone hits is not the model, the prompt, or the framework — it is knowing whether a change made things better or worse. Without a way to measure quality, every improvement is a guess and every deploy is a gamble. Evaluation is the discipline that turns "it seems better" into "it is better, by this much," and it is the real bottleneck in shipping AI systems.
Building with an LLM is easy for a weekend and hard for a year, and the wall almost everyone hits is knowing whether a change made things better or worse. Without measurement every improvement is a guess — evaluation is the discipline that turns "it seems better" into "it is better, by this much," and it's the real bottleneck in shipping AI.
"Just hash the password" is advice that's simultaneously right and dangerous — right that you never store plaintext, dangerous because a fast cryptographic hash like SHA-256 is exactly the wrong tool for passwords. Hashing, message authentication, and password storage are three different jobs that all involve hashing, and confusing them is a classic source of real breaches.
'Just hash the password' is simultaneously right and dangerous — right that you never store plaintext, dangerous because a fast hash like SHA-256 is the wrong tool for passwords. Hashing, MACs, and password storage are three different jobs that all involve hashing.
Hand-tuned prompt strings are brittle, model-specific, and impossible to systematically improve — DSPy replaces them with declarative modules and an optimizer that writes the prompts for you.
Hand-tuned prompt strings are brittle, model-specific, and impossible to improve systematically. DSPy replaces them with declarative modules and an optimizer that writes the prompts for you.
Modern production AI is rarely "a model" — it is a foundation model wrapped in retrieval, context engineering, tools, and guardrails — and the biggest architectural mistake is reaching for fine-tuning before exhausting the cheaper, more reversible options.
Production AI is rarely a model — it's a composed system, and the biggest mistake is fine-tuning before exhausting cheaper, reversible options. Phase 3: compose before you train.
The retrieve-then-generate pipeline that launched a thousand demos hits a wall on real questions, and understanding exactly where it breaks is the case for making retrieval agentic.
The retrieve-then-generate pipeline that launched a thousand demos hits a wall on real questions. Understanding exactly where naive RAG breaks is the case for making retrieval agentic.