Essays

Shorter or more opinionated pieces: how security teams interact with delivery, trade-offs, tooling, and day-to-day engineering—not always tied to a single product or incident.

This page is regenerated on each site build from Markdown notes in this folder (categories and one-line summaries live in tools/home_browse.yml).

Security engineering practice

• A systematic approach to product security — Turn shift-left ideals into repeatable product-security practice across phases and priorities.
• Security tasks and prioritization — How capable engineers prioritize macro security work and micro risk signals.
• Security as coding intelligence — Why AI-era development needs security as embedded rules and intentional friction.
• Guardrails and the security engineer’s role — Four security-engineer roles from observer to gatekeeper—and how much each steers delivery.

Mental models & threat modeling

• From mental model to security model — Move from “how the system works” to “how it can fail” in reviews.
• Threat Modeling Case Study: Car Firmware Update via USB Stick — USB firmware-update case study—structured threats beyond sign-and-encrypt.
• Understanding threats, vulnerabilities, and risk — Threat, vulnerability, and risk as a usable mental model—not interchangeable labels.

Security code review

• Security code review: trends and practice in the AI era — Evidence and operating model for LLM-assisted review without abandoning human judgment.
• Build security code review confidence: from uncertain to certain — A path from ambiguous code to defensible review confidence.

GenAI / ML security

• Study note — The Developer’s Playbook for Large Language Model Security — Personal study companion to Wilson’s LLM security playbook (not a substitute for the book).
• How-to: End-to-end ML model and GenAI application security — Lifecycle checklist for securing ML and GenAI applications end to end.
• Study note — Prompt engineering (PE4LLM) — Notes on prompt/context engineering—what LLMs do and do not “understand.”

Compliance & research

• Research: China PIPL and U.S. PADFAA / DOJ DSP compliance — Working comparison of China PIPL and U.S. PADFAA / DOJ DSP for vendor and eng roles.

Templates

• Template — Security architecture review document — Reusable outline for application security architecture reviews.

If a thread grows into a long-running series, consider moving it under Minibooks or Incidents instead.