When a Security Check Can Never Turn Red
I keep finding automated checks that were built to catch a real problem but structurally can never fail. A passing check and a working check are not the same thing.
security
IT-Sicherheit ist das Fundament jeder digitalen Infrastruktur. Sie schützt Systeme, Netzwerke und Daten vor Angriffen, Ausfällen und Missbrauch. Dabei geht es um mehr als Virenschutz: Es ist die Strategie zur Sicherung der Verfügbarkeit, Integrität und Vertraulichkeit Ihrer Unternehmenswerte. In diesem Bereich finden Sie praxisnahe Analysen zu Bedrohungen, aktuelle Warnmeldungen und Anleitungen zur Härtung Ihrer IT-Landschaft – für resiliente Systeme, die auch im Ernstfall stabil bleiben.
GitLost Changed the Agent Attack Surface
GitLost is a useful warning: in agentic workflows, public issues, comments, and tickets can become part of the supply chain.
The Supply Chain Risk Between CI Workflows
Cordyceps is a useful reminder that some CI/CD risks do not live in one workflow file. They live in the trust boundary between workflows.
Why Ambiguity Needs Its Own State
Automation fails quietly when unclear inputs are forced into yes or no decisions. The safer pattern is to treat ambiguity as its own state.
I scanned the leaked Claude Code source before building it
I scanned a widely-shared copy of leaked Claude Code source before running it. The scanner returned a critical score. Here is what the findings actually mean, and why the repository distributing it deleted my comments.
How We Swept 25 Repos for Security Issues in an Afternoon (and What We Actually Found)
A practitioner's account of running a full Dependabot and CodeQL sweep across an entire GitHub organization, fixing real vulnerabilities, and hardening a production server the same day.
NIS2 for Mid-Sized Companies: What Actually Matters
NIS2 is here and most mid-sized companies don't know if they're affected. Here's a practical checklist from someone who's been through TISAX.
How GlassWorm Gets In (and How We Locked It Out)
A supply-chain malware campaign hit hundreds of repos across GitHub, npm, and VS Code. Here's what I found when I scanned my own projects.
Who's Responsible When AI Breaks the Rules It Wrote Itself?
Here's something that should make you uncomfortable.
🛡️ Fortinet Monthly Recap | February 2026
Monthly Overview February 2026.
AEGIS: The European Powerhouse Strategy: How AEGIS Unleashes Europe's Economic Sovereignty
Europe is often said to have lost the technological race to the USA and Asia. At Elvatis, we consider this diagnosis to be fundamentally wrong.
Autonomy Needs Privacy Guardrails: The GitHub Leak That Should Not Have Happened
I automated a backup, accidentally staged the wrong things, and had to delete history. Here is the rollout discipline that keeps this from happening again.