Blog
Field notes on OSINT, security checks, SEO, and safer hiring and vendor due diligence.
-
Using the pkg.go.dev API in Go dependency review
2026-08-03
The pkg.go.dev API gives Go teams a stable way to pull package metadata into CI, dependency review, and SBOM workflows. The value comes from using it for module identity, license checks, and review triggers, then joining it with native Go tooling.
-
How I Vet Job Outreach as an Infrastructure Problem
2026-08-02
A job message is easier to judge when you treat it as infrastructure instead of copy. These field notes map the technical and process signals worth checking across email, domains, documents, and hiring workflows.
-
Verify-first signals in recruiter and job-offer workflows
2026-08-01
A safer hiring workflow starts by checking infrastructure, documents, and sequence, not just the wording of a recruiter message. These field notes focus on the technical and operational signals that help practitioners verify outreach before trust is extended.
-
What altered TV sticks reveal about embedded Android trust
2026-07-31
Krebs highlighted TV streaming sticks that may arrive with altered Android firmware. The real practitioner problem is the device trust model: boot integrity, update signing, outbound traffic, and the Android fork hidden under the launcher.
-
Job scam signals hide in the infrastructure, not the pitch
2026-07-30
Job-scam review works better as lightweight incident response than gut feeling. Starting from sender domains, headers, redirect chains, and document metadata exposes the technical seams that mass recruiting fraud often leaves behind.
-
What easy-apply hiring flows hide from defenders
2026-07-29
A one-click application flow is really a chain of trust boundaries. The useful signals are in redirects, recruiter-channel metadata, identity handoffs, and document handling, not in the convenience of the button.
-
Ghost jobs leave infrastructure traces if you know where to look
2026-07-28
A source on ghost jobs is a useful prompt to look past wording and into the machinery of hiring fraud. The durable signals are in domains, mail headers, PDFs, identity residue, and workflow handoffs.
-
The silent technical checks behind a job posting
2026-07-27
A credible-looking job post is only one layer of the story. The better signal sits in the infrastructure around it: domains, email authentication, workflow design, and document integrity.
-
Technical signals to inspect in a job search
2026-07-26
A safe job search is less about reading polished messages and more about inspecting the infrastructure behind them. These field notes focus on the technical signals around recruiting emails, links, documents, and identity handoffs that practitioners should verify.
-
Job postings as attack surface: what to inspect in hiring flows
2026-07-25
A note from the security side of job-search risk: the real surface is the hiring workflow itself, from career-site domains and ATS redirects to email authentication and document handling. The useful signals are in the infrastructure and the inconsistencies around it, not in any single claim about a posting.