Articles — Field notes
Read
this first.
The expensive mistakes I keep seeing in real codebases, and what to do instead. Each article pairs with a premium skill pack if you want your AI agent to get it right every time.
Why your MCP server is a prompt-injection risk
MCP tools let attacker-controlled text drive real actions. How prompt injection and the lethal trifecta lead to data theft, and the defences that hold up.
10 minMCPAI agentsPrompt injectionSecurityThe security bugs your scanner won’t find
SAST, DAST and dependency scanners miss logic flaws. IDOR, mass assignment, race conditions, JWT and SSRF mistakes, with examples, and how to review for them.
9 minApplication securityOWASPCode reviewAPIsLoad testing with k6: what most guides get wrong
Common k6 load testing mistakes and how to avoid them: open-model arrival rates, percentiles, thresholds, realistic workloads and server-side correlation.
9 mink6Load testingPerformanceScalabilityMulti-tenant SaaS: the isolation mistakes that leak customer data
How multi-tenant SaaS apps leak customer data, and how Postgres row-level security, transaction-scoped tenant context and two-tenant tests prevent it.
9 minSaaSMulti-tenancyPostgreSQLRow-level security