Security

A phone with no network cannot log anyone in. It can unlock cached data: device-bound key wrappers, crypto-bound biometrics, expiry that counts sleep.

~/.claude and ~/.codex mix config with logins and plaintext transcripts. Back up what you wrote, exclude credential files, and log in again on restore.

Selecting the latest row per account discards other devices. Label that metric precisely, and aggregate per device before asking about fleet exposure.

Regex extraction can assign a CVE to the wrong advisory without changing the distinct-ID total. Parse declaration blocks and test exact relationships.

A device-clock rollback can make an expired cache look fresh. Reject future timestamps, retain a clock high-water mark, and recheck at unlock.

A 2026 iOS jailbreak defense needs threat modeling, layered signals, server enforcement, and bypass testing—not another Cydia path check.

How a Go security skill became an OWASP LLM review skill, then an iOS mobile security skill, by keeping the review method and adapting the risks to the product.

A practical starting setup for building production apps with coding agents across different stacks, issue trackers, and model families.

fail2ban listed the address as banned, and the address still got in. On a Debian host with firewalld, the nft binary was missing, so every ban had failed.

Security transcripts mix observations with model guesses, and classifiers may stop the audit. Preserve provenance, checkpoints, and a provider-neutral handoff.