Cloud Security & ComplianceYou changed every password and they're still in
Why an attacker can return after you reset every password, and the order to clean up in: device, then email, then everything email can reset.
Cloud Security & Compliance
Field notes from building and auditing regulated cloud estates.
These articles come from security work on Azure estates and the platforms that run on them: what a SIEM is actually detecting and what it costs, what “HSM-backed encryption” covers resource by resource, why a private endpoint may not be carrying your traffic, how to roll out an EDR agent without breaking the machines that already have one, tenant isolation that fails closed inside the ORM, and what to secure when the one engineer who understood a platform leaves. Client names are withheld unless the client agreed to be named.
For the engineering behind the notes, see Cloud Security & Compliance.
10 articles
Cloud Security & ComplianceDocuSign JWT Grant: the failures you will actually hit
Wiring DocuSign embedded signing with JWT Grant: why invalid_grant hides the cause, the consent step, demo vs production, CSP, return URLs and branding.
Adding DocuSign embedded signing to your application
A step-by-step guide to DocuSign embedded signing with JWT Grant: account setup, consent, tokens, envelopes, the signing view, evidence and going live.
Cloud Security & ComplianceEnforcing a Content Security Policy on a static site behind Azure Front Door
How we took a static site from no security headers to an enforced CSP with zero refusals: what we removed first, report-only checks, Front Door and HSTS.
Cloud Security & ComplianceWhat "HSM-backed encryption" actually covers in an Azure estate
HSM-backed describes who holds the key, not how strong the encryption is. How to state Azure encryption-at-rest coverage per resource type, with evidence.
Cloud Security & ComplianceRolling out an EDR agent with Terraform: installed is not running
How to make an Azure Custom Script Extension safe to run against VMs that already carry an EDR agent, and keep the site token out of the repository.
Cloud Security & ComplianceFail-closed tenant isolation in an ORM
How Omnisnia enforces tenant isolation in GORM callbacks that refuse unscoped queries, with an explicit system scope, tests, and where RLS fits.
Your Azure OpenAI private endpoint may not be carrying your traffic
A private endpoint existing does not mean traffic uses it. Two DNS problems that kept Azure OpenAI calls on the public endpoint, and how to check yours.
Key-person risk after an engineer leaves
A continuity checklist for when the one engineer who understood your platform leaves: secrets, state, credentials, access and ground truth.
Cutting Microsoft Sentinel cost without blinding your detections
Four lessons from reducing Sentinel and Log Analytics cost for a healthcare client, including the cheaper table plan that silently emptied 33 detections.