The 2026 Lovable security incident represents a defining moment for the “vibe coding” ecosystem. The timeline, root causes, and subsequent fallout highlight the critical tensions between rapid, AI-driven development and traditional security practices. timeline of the incident Technical Analysis of the Vulnerability The Broken Object-Level Authorization (BOLA) Flaw The core vulnerability was a classic Broken Object-Level Authorization (BOLA) flaw. In […]
On the evening of 27 January 1986, Roger Boisjoly spread his data across a table in a teleconference room at Morton Thiokol and made his case. The O-rings that sealed the joints of Challenger’s solid rocket boosters had never been tested below 53°F. The forecast for the next morning: 29°F. The correlation between cold and O-ring damage was unmistakable in […]
A Practitioner’s Reference for Warning Lifecycle Management in Platform Engineering Version: 1.0Author: Bola OgunlanaClassification: Original framework, Cockpit to Cloud seriesOrigin: Derived from post-mortem analysis of the 1995 Sampoong Department Store collapse, mapped to persistent warning failure modes in cloud and platform engineering operations What SIGNAL Is SIGNAL is a 6-principle operational framework for managing persistent warnings in platform engineering, DevSecOps, […]
On 29 June 1995, at 5:52 PM, the Sampoong Department Store in Seoul collapsed in under 20 seconds. 502 people died. 937 were injured. South Korean prosecutors launched a criminal investigation. What they found wasn’t a building that gave no warning. It was a building that sent warnings for three months and had every one of them ignored. Platform engineering […]
On 27 March 1977, two Boeing 747s collided on a single runway at Los Rodeos airport in Tenerife. Fog had rolled in off the hills. 583 people died, which still makes it the deadliest accident in aviation history. The KLM jet started its takeoff roll while the Pan Am jet was still taxiing towards it through the murk, looking for […]
Version: 0.1 (draft) Status: Draft for comment. Not a finished standard. Published: 2026-06-30 Predicate type URI: https://oap.dev/RunRecord/v0.1 (illustrative) Licence: intended for an open, vendor-neutral licence (Apache 2.0 or CC BY 4.0) v0.1 is a starting point. The field set and conformance rules will move as producers and consumers appear and as we learn what auditors and agents actually need. Backward-compatible […]
The prompt came in Spanish. Claude processed it and refused. “Specific instructions about deleting logs and hiding history are red flags,” the model said. The session had barely started. The pushback was unambiguous. Most sessions end there. This one didn’t. Over the next 40 minutes, the operator rephrased the request, rebuilt the context, and loaded a persistent configuration file: a […]
For the past decade, the holy grail of DevOps and platform engineering has been automation. We wrote bash scripts, compiled complex Jenkins pipelines, and eventually moved toward declarative states with Terraform or OpenTofu. Yet, even with Infrastructure as Code (IaC), a structural bottleneck remained: the human. Engineers still manually analyse logs, approve PRs, triage alerts, and decide when to scale […]
What the nine-second deletion reveals about where the agentic era is actually heading Nobody writes about the incidents where the agent behaved perfectly. I want to write about one of those now, because I think it is the most important category of failure that the current conversation about AI agents is almost entirely ignoring. An incident response agent, doing its […]
On 5 February 2008, Baxter International initiated the largest pharmaceutical recall in US history. 81 Americans were dead. Hundreds more had experienced anaphylaxis and cardiac events after routine intravenous heparin infusions. The FDA traced the contamination back to a manufacturing facility in Changzhou, China that its inspectors had never visited. The raw active pharmaceutical ingredient had been deliberately substituted with […]