Blog

Field Notes

Working notes on application security, AI security, secure development, software security standards, and the software supply chain. Written by the people doing the work, not a content team.

Latest
Application Security 79 min read

SQL Injection: Beyond Parameterized Queries

A bug from 1998 still drives 2026's biggest breaches. The channel taxonomy, the dialect differences, why prepared statements actually work, and the places parameterization quietly fails.

Read article
Software Security Standards 11 min read

What the New Wave of AI Security Standards Actually Asks of You

ISO/IEC 42001, the NIST AI RMF, the OWASP LLM Top 10, and the EU AI Act are converging on how to secure AI systems. What's settled, what isn't, and what to do now, from someone editing in this space.

Read article