Blog

The Agent Takes Over Operations

Cron jobs and CI pipelines have been running on our servers with far-reaching permissions for years, and hardly anyone thinks twice about it. An AI agent is different, because it decides for itself how to solve a problem. This article looks at how to give an agent access to servers without giving up control.

Trust but Sandbox

Coding agents can now do (almost) everything. They read and write every file you have access to, they run arbitrary commands, talk over the network, read your environment variables, and drive your browser with all your cookies. In the spirit of an agentic workflow, where we let agents work as autonomously as possible, that is actually the point, because it is exactly what makes them useful. Even so, we should find a way to gain more control over what happens in there.

Stop Using Bearer Tokens Like House Keys

DPoP with Heimdall

Nebu: Self-made sovereignty

There are plenty of open-source alternatives to Slack. None of them deliver real sovereignty. Community editions are deliberately pared down so no company can run them in production, while enterprise features sit behind commercial licenses. This article shows why “building it yourself” is no longer a utopian idea today, but a realistic option for anyone with a product vision and a bit of DIY courage.

Neuland reloaded

When Angela Merkel said in 2013 that the internet is ‘Neuland’ (uncharted territory) for all of us, the amusement online was considerable. Viewed from some temporal and substantive distance, one can now recognize a perspective from which she was indeed correct.

Let’s Not Normalize Insecure AI Assistants

How the Lethal Trifecta Makes Today’s AI Assistants Unsafe by Design

I sandboxed my coding agents. You should too.

LLM coding agents are extremely powerful because they can run programs on our computers using our permissions. However, this same power also makes us very vulnerable. It only takes one mistake or one prompt injection to compromise the whole system.

Managing Geopolitical Risks with Enterprise Architecture

IT leaders in Europe increasingly face questions about whether geopolitical developments – such as data protection disputes or trade conflicts between the EU and the US – threaten the viability of US cloud services. The risks range from price increases and legal uncertainties to potential usage restrictions. CIOs must not only ensure functional IT operations but also proactively assess external risks. This article demonstrates how enterprise architecture methods can help identify risks early and develop viable alternatives.

The Path to Heterogeneous Cloud Platforms

A Governance Framework for Digital Sovereignty

In an increasingly connected world where digital infrastructure forms the backbone of our economy and society, the topic of digital sovereignty is gaining more and more attention. For decision-makers in German-speaking countries, this goes far beyond merely selecting a cloud provider. It’s about strategic agency, resilience, and the ability to actively shape one’s digital future. This article explores how a robust governance methodology can help organizations not only understand digital sovereignty but also put it into practice—without sacrificing convenience or innovation.

Updating OWASP’s Microservice Security Cheat Sheet: Practical Considerations & Recommendations

Turning principles and patterns into practice — just as promised.

Updating OWASP’s Microservice Security Cheat Sheet: Decision Dimensions for Authorization Patterns

Updating OWASP’s Microservice Security Cheat Sheet: Authorization Patterns

Authorization patterns explain how distributed systems organize their access control — where and how decisions happen, where policies live — and influence, in turn, how identities and related attributes travel between components.

Updating OWASP’s Microservice Security Cheat Sheet: Identity Propagation Patterns

Without trustworthy identity propagation, even strong initial authentication can be undermined — weakening trust boundaries and ultimately impairing the system’s ability to make reliable authorization decisions.

Updating OWASP’s Microservice Security Cheat Sheet: Authentication Patterns

What’s Wrong with the Current OWASP Microservice Security Cheat Sheet?

Modern microservice architectures require evolving security practices. Yet popular resources like the OWASP Microservice Security Cheat Sheet are starting to show their age and need a fresh look.

Updating OWASP’s Microservice Security Cheat Sheet: Core Concepts

In part two of my series, I begin the journey to rethink the OWASP Microservice Security Cheat Sheet. This post focuses on core concepts, laying the groundwork for practical, real-world microservice security.

Beyond the hype: An engineer’s journey into ReBAC and AI with the Model Context Protocol

Improve your CSP with Style Nonces in Angular 16

What to do, to enable your Angular application to use style-src: nonce in a CSP for stricter security rules

How to Encrypt a File on the JVM

You’ve got a secret password and some bytes you’d like to encrypt. JVM has all the tools you need to get it done.

How to use and build your own distroless images

CORS extension “Private Network Access”

Chrome rolled out the “Private Network Access” extension for its CORS handling. Let’s try to understand the why and how this is affecting us.

A Playground for Testing OpenID Connect

This post describes how you can set up a development environment in order to play around with your OpenID client implementation. When running your application in a cluster, it can be difficult to test how it will behave behind a load balancer. One factor that can be particularly difficult to test is when you are communicating with an OAuth 2.0 or OpenID Connect server which expects that a request will be redirected back to the same application instance that it came from.

Secure Kubernetes Cluster

Why, even with Docker and Kubernetes, there is still work to be done on security issues

Have YOU been pwned?

With the V2 release of the “pwned passwords” database came a new feature called range search, which allows to securely check passwords with only minor efforts. Here’s how to use it.