AI systems.Security decisions.Practical insight.
Independent writing on cybersecurity and AI systems. Ideas, experiments, and tools for understanding what comes next.
Read the latestThreat Modeling for AI Agent Systems
Threat modeling fails because it runs as a quarterly workshop. Run it in sprints, at the architecture layer, and start with the agent surfaces scanners can't see: tool calls, memory, MCP servers.
Read the articleExplore topics
Latest writing
All articles"Ask the User to Approve" Is Not a Security Control
Approval prompts get clicked through by the tenth repetition. Treat human review as a scarce resource and spend it where the blast radius is — everywhere else, enforce in code.
How to Build an Agent Audit Trail Before You Need It
The provider's copy expires on their clock. Build the trail you own — context snapshots, provenance, a config hash, into storage the agent can't rewrite.
Your AI Agent Has No Audit Trail
When an agent incident needs explaining, the evidence is already gone — context evaporates, and the provider's copy expires on a clock you don't set.
CSP Nonces and the Same-Origin Policy Solve Different Problems
A CSP nonce and the same-origin policy both show up in the same sentence about XSS, but they guard different boundaries — one says which script on this page is allowed to run, the other says which origin is allowed to read what. Confusing them leaves one of the two unguarded.
Your Voice Is Not a Password Anymore
Three seconds of audio from an old video is enough to convincingly be someone you love. The check that works doesn't happen on the call.
An independent perspective.
Darinor is a personal publication about cybersecurity and AI systems: offensive research, defense engineering, incident response, and the lessons from building things.
Everyday utilities
- X.509 Certificate DecoderDecode a PEM certificate's subject, issuer, validity, SANs, key usage, and fingerprints in your browser.
- CVSS CalculatorCompute a CVSS v3.1 base score, severity rating, and vector string.
- Word & Character CounterCount words, characters, sentences, paragraphs, and reading time live.
- Unix Timestamp ConverterConvert between Unix timestamps, ISO 8601, UTC, and local time.
- CSP Header AnalyzerAudit a Content-Security-Policy header for unsafe-inline, unsafe-eval, wildcard sources, and missing hardening directives.
- JSON Schema ValidatorValidate a JSON document against a JSON Schema, with every violation and its exact path.
- UUID GeneratorGenerate UUID v4 identifiers in bulk, with case and format options.