Security, privacy, and compliance
written for developers.
Practical, technically-accurate writing — vulnerability prioritization, secrets and PII detection, DPDP readiness, and securing what AI coding tools build for you.
Privacy & Compliance
DPDP Act vs DPDP Rules: What Changed and What Developers Need to Know
The Digital Personal Data Protection Act, 2023 is the law. The Digital Personal Data Protection Rules, 2025 tell you how to actually implement it. Here's the difference, the real enforcement timeline, and what it means for engineering teams.
How to Find Personal Data in Your Codebase
You can't secure or govern personal data you don't know you have. A practical guide to finding email addresses, phone numbers, ID numbers, and embedded credentials hiding in your source code and config — before a compliance deadline or a breach forces the question.
Privacy-as-Code: What It Means and Why Developers Need It
Privacy policy as a deterministic, version-controlled check that runs in CI — not a questionnaire, not a quarterly audit. What Privacy-as-Code actually is, what it can and can't verify, and why that honesty matters.
Security Research
CVSS vs EPSS vs CISA KEV: A Practical Comparison
Three vulnerability signals, three different questions. A practical guide to what CVSS, EPSS, and CISA KEV each measure, how they disagree, and how to combine them into a real prioritization workflow.
What Is CISA KEV and Why Does It Matter?
CISA's Known Exploited Vulnerabilities catalog tracks CVEs with confirmed active exploitation. Here's what it is, why it's the strongest remediation signal available, and how to use it alongside CVSS.
What Is an EPSS Score? A Plain-English Explanation
EPSS predicts the probability a CVE will be exploited in the next 30 days. Here's what the score actually represents, how it differs from CVSS, its limitations, and how to use it in prioritization.
Why CVSS Alone Is Not Enough to Prioritize Vulnerabilities
CVSS scores severity if exploited — not whether anyone is. Here's how CISA KEV and EPSS close that gap, with a practical composite scoring model.