Blog
Software Security Field Notes
Working notes on application security, AI security, secure development, software security standards, and the software supply chain. Written by the people doing the work, not a content team.
Featured
What Is Software Security? A Practical Guide for Teams That Ship Software
How software security differs from application and product security, the four places flaws come from, the frameworks that measure a program, and why customers and regulators now ask for evidence.
Read articleSQL Injection: Beyond Parameterized Queries
A bug from 1998 still drives 2026's biggest breaches. The channel taxonomy, the dialect differences, why prepared statements actually work, and the places parameterization quietly fails.
Read articleWhat the New Wave of AI Security Standards Actually Asks of You
ISO/IEC 42001, the NIST AI RMF, the OWASP LLM Top 10, and the EU AI Act are converging on how to secure AI systems. What's settled, what isn't, and what to do now.
Read article