Brennenstuhl on Security
Search

Jan Brennenstuhl Principal Engineer, Berlin

Security that makes the secure path the easy one.

Essays, a field guide and research notes on application security, identity, and the agents that now act on our behalf.

Latest Flagship

What I Learned Building an Identity Broker With Coding Agents

Magnus Jungsbluth and I built the open-source Agentic Identity Broker with coding agents from the first prototype. Over 10 months, I switched agent harnesses 6 times and used 9 models, and most of my lessons are about specs, tests, and review.

10 min read Read the essay

Now

Index

Every essay, grouped by topic. Chronological list Search RSS

Agentic Engineering 4

  1. What I Learned Building an Identity Broker With Coding Agents
  2. Guest Lecture at HTW Berlin: AppSec in the Age of Agentic Engineering AppSec for Agentic Engineering
  3. Shift Down: Why Agentic Engineering Demands Platform-Level Security AppSec for Agentic Engineering
  4. AppSec in the Age of Agentic Engineering AppSec for Agentic Engineering

Identity & Auth 2

  1. Step-Up Authentication: Elevating Security with OpenID Connect (OIDC)
  2. Passwordless Authentication: Future of Cybersecurity

AppSec 6

  1. Dependency Updates: latest Is Not a Security Strategy AppSec for Agentic Engineering
  2. Bunny Shield Review: 3 Things Need Improvement
  3. What is Whaling Cyber Awareness? Prevention Tips & Training Whaling
  4. Whaling Phishing: Definition and Prevention Strategies Whaling
  5. Honeytoken: Authentication Attack Breach Detection
  6. Weak Crypto, Github SAML Attack & Twitter Security UX

Passwords 6

  1. Password Attack Guide: What is Password Spraying?
  2. Passwordless: Critical Notes on FIDO2 Passkeys
  3. Long Password Support for Safer Login Systems Usable Password Security
  4. Max Password Length: A Secure Password Guide Usable Password Security
  5. How to Design a Strong & Usable Password Policy Usable Password Security
  6. How to: Password-Manager Friendly Login Forms Usable Password Security

Tokens & JWT 6

  1. What is JWA? A Deep Dive into JSON Web Algorithms JSON Web Tokens
  2. Mastering JWKS: JSON Web Key Sets Explained JSON Web Tokens
  3. JSON Web Encryption: Exploring JWE Token JSON Web Tokens
  4. JWT vs OAuth 2.0: Understanding the Key Differences JSON Web Tokens
  5. The Purpose of JWT: Stateless Authentication JSON Web Tokens
  6. Single-Use JWT: Unlocking the Power of Stateless One Time Token JSON Web Tokens

Engineering Practice 11

  1. Goodbye Big Tech: My European JAMstack Migration
  2. Bunny CDN: How to redirect Root Domain to Subdomain
  3. Learning AssertJ: Null ain't Blank
  4. On Making Spring Security OAuth RFC-compliant
  5. AWS DynamoDB: Backup & Recovery Strategy
  6. Evolution of a Microservice: A Git History Visualisation
  7. Abusing JSON: Why AWS CloudFormation sucks?!
  8. Python Docopt: Convert Tuple List to Dictionary
  9. How to Migrate SVN to GIT with History?
  10. How to Check Github Licenses
  11. AWS Monocyte: Let's Build a Cloud Immune System

Field guide

Short reference entries on identity, authentication and account security. Each one answers a question with a claim, shows the evidence behind it and states its review status. All entries Glossary

  1. Should an agent use a robot account or delegated access? Field Guide
  2. What should a password policy require? Field Guide
  3. What is inside a JWT? Field Guide
  4. How does OAuth 2.0 Token Exchange keep provider tokens away from agents? Field Guide
  5. How should people grant and revoke an agent's access? Field Guide
  6. How does authorization work for MCP servers? Field Guide