Blog

Deep-dive guides on AI agents, agent orchestration, MCP, and developer tooling.

5 posts found

Security

How TOTP Codes Actually Work: The HMAC Math Behind Your Authenticator App

Your phone and a server that have never exchanged a packet since enrollment somehow agree on the same six-digit code every 30 seconds — here is the RFC 6238 math that makes that possible, with a worked, verifiable example.

October 28, 2026 · 6 min read
MCP

MCP Authorization: How OAuth 2.1 Actually Secures a Remote MCP Server

MCP started as a trusted local subprocess with no auth story at all. Its authorization spec bolts on OAuth 2.1, PKCE, and resource indicators — here is what each piece actually prevents, including the token-passthrough bug that keeps showing up in early implementations.

August 5, 2026 · 9 min read
Security

JWK Rotation in Production: What Actually Breaks When You Rotate a Signing Key

Rotating a JWT signing key is a distributed cache-invalidation problem wearing a cryptography costume — here is the four-stage timeline, the kid collision that breaks it silently, and why your overlap window is set by your slowest verifier cache, not your token TTL.

August 4, 2026 · 7 min read
Security

Why Your Email Regex Is a Denial-of-Service Waiting to Happen

Catastrophic backtracking turned a routine validation regex into Cloudflare's 2019 global outage. Here is the exact pattern shape that causes it, why email regexes are especially prone to it, and which engines make the bug impossible.

July 30, 2026 · 6 min read
Security

bcrypt vs scrypt vs Argon2: How Password Hashing Actually Differs

MD5 and SHA-256 are fast, and fast is exactly the wrong property for password storage. Here is how bcrypt, scrypt, and Argon2 slow attackers down differently — and how to actually pick between them.

July 10, 2026 · 8 min read