platform security
4 posts
Article
The trust boundary already moved
Android telemetry from Google runs at the platform layer, below the owner's only enforcement surface. A trust-model condition, not a vulnerability.
Article
The zero-days are not the problem.
An anonymous GitHub account published undisclosed zero-days. The finding is not the exploits. It is an identity boundary that was never enforced at the action.
Article
GitHub breached. Scope unknown.
GitHub disclosed an internal data breach with no mechanism stated. Operator analysis of confirmed facts, structural exposure, and required tenant action.
Article
OAuth ate your secrets
The Vercel OAuth breach shows environment variables are not protected by location, only by the identity assertion placed in front of them.