I test what ships and publish what I find, failures included: 100+ public repositories, every restore script run by CI, every finding on the ledger with its rule.
One of fewer than 250 Docker Captains worldwide, a CNCF Ambassador, and Technical Editor of "Docker and Kubernetes Security."
Free, no sign-up
Blueprints
My videos and posts used to end by sending you to a paid channel for the blueprint. The channel is closed. The blueprints are here, rewritten, and free. Each is a procedure you can run this week, opened by the dated signal it answers. Where my own repositories measure the same rule, the numbers are linked.
-
The blast radius assessment: before an AI agent touches a live system
Map what an AI agent can break, and how fast a person can undo it, before it gets a single key: six steps, a worksheet and the repositories that measure the same rules.
-
The AI intake gate: before an AI tool reaches company data
Find every AI tool in use, ask for its backend's access rules instead of a questionnaire, and block what cannot use SSO and central logging, before the first prompt.
-
Build or buy a no-code AI platform
When a no-code computer vision subscription is the right buy, when it is a slow trap, three questions before the pilot and four clauses before you sign.
-
Admit a model by its AI-BOM, not by its signature
Write a signed AI-BOM for every model from its lock line, read it at admission, and refuse any model unless every licence it declares is on the site's list.
-
Decision rights for AI agents when nobody reviews
Keep money, publication and history out of an agent's reach by mechanism, and let each repository's own verification, not auto-merge, decide what merges.
-
Mutation testing for infrastructure code, one planted violation per promise
Write what each repository promises, plant the smallest edit that breaks each promise, and fail the build when a test stays green or a plant goes stale.
-
The red-case audit: prove every health check can fail
Run each health check against a case it must fail, name the binary that serves, keep errors apart from empty answers, and make something act on the label.
