The 2026 Lovable security incident represents a defining moment for the “vibe coding” ecosystem. The timeline, root causes, and subsequent fallout highlight the critical tensions between rapid, AI-driven development and traditional security practices. timeline of the incident Technical Analysis of the Vulnerability The Broken Object-Level Authorization (BOLA) Flaw The core vulnerability was a classic Broken Object-Level Authorization (BOLA) flaw. In […]
Purpose: A meta-framework, a binary, all-or-nothing governance gate that must be satisfied before any AI or automated system is granted execution authority over a production environment, at any level of autonomy. Core principle: Autonomous authority is prohibited by default. A full WARRANT lifts that prohibition. A WARRANT must be earned, not assumed. Not a maturity model. No partial credit. All […]
On the evening of 27 January 1986, Roger Boisjoly spread his data across a table in a teleconference room at Morton Thiokol and made his case. The O-rings that sealed the joints of Challenger’s solid rocket boosters had never been tested below 53°F. The forecast for the next morning: 29°F. The correlation between cold and O-ring damage was unmistakable in […]
A Practitioner’s Reference for Warning Lifecycle Management in Platform Engineering Version: 1.0Author: Bola OgunlanaClassification: Original framework, Cockpit to Cloud seriesOrigin: Derived from post-mortem analysis of the 1995 Sampoong Department Store collapse, mapped to persistent warning failure modes in cloud and platform engineering operations What SIGNAL Is SIGNAL is a 6-principle operational framework for managing persistent warnings in platform engineering, DevSecOps, […]
On 8 August 2022, the US Treasury sanctioned Tornado Cash. Not its founders. Not its users. The code itself. Forty-four Ethereum smart contract addresses were placed on the OFAC Specially Designated Nationals list, alongside arms dealers and sanctioned regimes. Within hours, Infura and Alchemy cut off API access. Circle blacklisted USDC held inside the contracts. GitHub suspended the repository and […]
On 27 March 1977, two Boeing 747s collided on a single runway at Los Rodeos airport in Tenerife. Fog had rolled in off the hills. 583 people died, which still makes it the deadliest accident in aviation history. The KLM jet started its takeoff roll while the Pan Am jet was still taxiing towards it through the murk, looking for […]
Version: 0.1 (draft) Status: Draft for comment. Not a finished standard. Published: 2026-06-30 Predicate type URI: https://oap.dev/RunRecord/v0.1 (illustrative) Licence: intended for an open, vendor-neutral licence (Apache 2.0 or CC BY 4.0) v0.1 is a starting point. The field set and conformance rules will move as producers and consumers appear and as we learn what auditors and agents actually need. Backward-compatible […]
The prompt came in Spanish. Claude processed it and refused. “Specific instructions about deleting logs and hiding history are red flags,” the model said. The session had barely started. The pushback was unambiguous. Most sessions end there. This one didn’t. Over the next 40 minutes, the operator rephrased the request, rebuilt the context, and loaded a persistent configuration file: a […]
For the past decade, the holy grail of DevOps and platform engineering has been automation. We wrote bash scripts, compiled complex Jenkins pipelines, and eventually moved toward declarative states with Terraform or OpenTofu. Yet, even with Infrastructure as Code (IaC), a structural bottleneck remained: the human. Engineers still manually analyse logs, approve PRs, triage alerts, and decide when to scale […]
What the nine-second deletion reveals about where the agentic era is actually heading Nobody writes about the incidents where the agent behaved perfectly. I want to write about one of those now, because I think it is the most important category of failure that the current conversation about AI agents is almost entirely ignoring. An incident response agent, doing its […]