The Blog
Product Security in the Real World
The gap between "we have a threat model" and "we're actually secure" is where most of this blog lives.
August 18, 2026
CVSS Scores Are Lying to You
CVSS scores describe how bad a vulnerability could be in theory. They say nothing about your product. Here's why context is everything in vulnerability triage.
Read post →August 5, 2026
We Built an API Into Our Security Platform. Then We Connected Claude Code.
PSH started as a web app. Then we built a full REST API — and connected Claude Code to it. Here's what changed about how we work.
Read post →August 4, 2026
The FDA Wants Traceability, Not Documents
The FDA doesn't want PDFs. They want connected evidence. Here's why traceability is infrastructure, not paperwork — and what it looks like when it actually works.
Read post →