INNOQ Technology Night in Munich: Cloud-Migration & KI im Arbeitsalltag: Die produktive Einsamkeit 👉 11 Aug 18:00

Blog

Trust but Sandbox

Coding agents can now do (almost) everything. They read and write every file you have access to, they run arbitrary commands, talk over the network, read your environment variables, and drive your browser with all your cookies. In the spirit of an agentic workflow, where we let agents work as autonomously as possible, that is actually the point, because it is exactly what makes them useful. Even so, we should find a way to gain more control over what happens in there.

Stop Using Bearer Tokens Like House Keys

You’ve built an API. You protected it with OAuth 2.0. You’re using JWTs. You feel secure. You’re not.

Nebu: Self-made sovereignty

How I’m building an enterprise chat server with agentic development that simply doesn’t exist.

Neuland reloaded

When Angela Merkel said in 2013 that the internet is ‘Neuland’ (uncharted territory) for all of us, the amusement online was considerable. Viewed from some temporal and substantive distance, one can now recognize a perspective from which she was indeed correct.

Let’s Not Normalize Insecure AI Assistants

AI assistants like OpenClaw promise convenience, autonomy, and increasingly personalized help. But beneath that promise lies an architecture that quietly combines private data, internet access, and exposure to untrusted content—the lethal trifecta of security risk. Sandboxing and physical isolation help, but they don’t address the core problem. As we add more capabilities, the potential blast radius only grows. This post is a case for slowing down, questioning defaults, and refusing to normalize insecure architectures.

I sandboxed my coding agents. You should too.

My Lima VM + JetBrains Gateway setup for safe agentic development

Managing Geopolitical Risks with Enterprise Architecture

IT leaders in Europe increasingly face questions about whether geopolitical developments – such as data protection disputes or trade conflicts between the EU and the US – threaten the viability of US cloud services. The risks range from price increases and legal uncertainties to potential usage restrictions. CIOs must not only ensure functional IT operations but also proactively assess external risks. This article demonstrates how enterprise architecture methods can help identify risks early and develop viable alternatives.

The Path to Heterogeneous Cloud Platforms

Digital transformation brings both challenges and opportunities for businesses. To create future-proof and flexible IT infrastructures, more and more companies are adopting multi-cloud or hybrid cloud strategies. This isn’t just about cost reduction, but also about aligning innovative services from different providers with regulatory requirements - particularly in the area of data protection. This article shows how targeted integration strategies can help you leverage the benefits of multi-cloud to optimize your existing infrastructure, reduce technical dependencies, and ensure long-term business success.

A Governance Framework for Digital Sovereignty

Updating OWASP’s Microservice Security Cheat Sheet: Practical Considerations & Recommendations

Turning principles and patterns into practice — just as promised.

Updating OWASP’s Microservice Security Cheat Sheet: Decision Dimensions for Authorization Patterns

Choosing the right patterns is critical, as it directly impacts the system’s security posture, performance, scalability, and maintainability.

Updating OWASP’s Microservice Security Cheat Sheet: Authorization Patterns

Updating OWASP’s Microservice Security Cheat Sheet: Identity Propagation Patterns

Without trustworthy identity propagation, even strong initial authentication can be undermined — weakening trust boundaries and ultimately impairing the system’s ability to make reliable authorization decisions.

Updating OWASP’s Microservice Security Cheat Sheet: Authentication Patterns

Without knowing who the subject is, without verifying its identity, there is only a limited way to perform meaningful access decisions.

What’s Wrong with the Current OWASP Microservice Security Cheat Sheet?

Updating OWASP’s Microservice Security Cheat Sheet: Core Concepts

In part two of my series, I begin the journey to rethink the OWASP Microservice Security Cheat Sheet. This post focuses on core concepts, laying the groundwork for practical, real-world microservice security.

Beyond the hype: An engineer’s journey into ReBAC and AI with the Model Context Protocol

In this article, I share my experiences on my journey into the AI world. During this journey, we’ll build our own Model Context Protocol (MCP) Server using C Sharp, learn about access management with relationship based access control (ReBAC) on the way, and in the end I’ll provide my thoughts on the current state of AI and MCP, focusing on security and UX.

Improve your CSP with Style Nonces in Angular 16

Enabling stricter content security policies in your SPA

How to Encrypt a File on the JVM

You’ve got a secret password and some bytes you’d like to encrypt. JVM has all the tools you need to get it done.

How to use and build your own distroless images

Security and efficiency are key goals in production systems. This begins when we build our application images and look for a suitable base image. So what are good base images and how do distroless images fit into this picture?

CORS extension “Private Network Access”

Understanding the new preflight requests

A Playground for Testing OpenID Connect

This post describes how you can set up a development environment in order to play around with your OpenID client implementation. When running your application in a cluster, it can be difficult to test how it will behave behind a load balancer. One factor that can be particularly difficult to test is when you are communicating with an OAuth 2.0 or OpenID Connect server which expects that a request will be redirected back to the same application instance that it came from.

Secure Kubernetes Cluster

Containers and Kubernetes have greatly simplified the way we bring software into production. Applications can be packaged in container images and run on a Kubernetes cluster with 5000+ nodes. However, it should not be forgotten that, despite being encapsulated in containers, various aspects of safety still have an important role to play.

Have YOU been pwned?

How to check your passwords securely and effortless

Enforce strong passwords!

Frequent leaks of large user databases highlight how important it is to enforce strong passwords. Let’s discuss what makes a strong password and why it is a good idea to additionally check it against a dictionary.