ChatGPT share-link account takeover: the postMessage bug, and how to secure your own listeners
How a ChatGPT share link ran code as chatgpt.com through MathLive's postMessage listener, and the listener, iframe and CSP fixes for your own app.
System architecture
Data models, migrations and the decisions that are expensive to reverse.
System architecture articles
Northflank breach: what to rotate first, and how to check whether your AI keys were abused
Northflank says assume every environment variable was decrypted. What to rotate first, how to spot abused AI keys in CloudTrail, and how to scope the next one.
Binance $6.3B hack explained: how EIP-7702 delegation emptied a hot wallet, and how to guard your signer
How 50 pre-signed EIP-7702 authorizations emptied a Binance hot wallet, what Binance has said, and the signer checks that would have refused them.
OpenCode Console breach: which API keys were exposed, and how to rotate them without an outage
What the OpenCode Console breach exposed, who is affected, and a safe order for rotating OpenAI, Anthropic and Google API keys.
NIST P-256 seed origin solved: how lrand48 and a 1997 timestamp made the ECDSA curves, and what it means for you
The NIST P-256 seed came from lrand48 and a 1997 timestamp. Rebuild it in Python and C, and see what it means for the ECDSA keys you use.
Microsoft's record October 2026 Patch Tuesday: how to triage 1,400 CVEs with exploit status, risk cohorts and VEX
October's Patch Tuesday fixed about 1,400 CVEs. A triage order, what risk cohorts miss, VEX, and a script that sorts the release.
Supermarket fridge hack: how exposed Danfoss controllers were pushed to 50°C, and how to find yours
How the French supermarket fridge attack reached Danfoss controllers, what the known CVEs allow, and how to find and close the same exposure.