Security that makes the secure path the easy one.

Building software with coding agents, and giving agents scoped, revocable authority over the tools they use.

OpenID Connect, OAuth, passkeys and step-up: who is acting, on whose behalf, and how strongly that was proven.

Secure defaults, platform-level controls and the attacks they have to hold against, from phishing to supply chains.

Password policies that people can follow, systems that do not punish password managers, and the attacks on reused credentials.

JSON Web Tokens and the JOSE family: what tokens are for, how they are signed, encrypted and verified, and where they go wrong.

Notes from running software: cloud infrastructure, European hosting, tooling and the occasional migration.