Engineering notes from production

Dispatches from the infrastructure trenches_

Long-form writing on security, Kubernetes, platform engineering, and the operational realities of keeping production systems alive.

2026-03-28 security kubernetes llm observability

Building an LLM-Powered SIEM That Fits in a Single File

How a single Python script and an LLM endpoint can turn your Kubernetes cluster logs into actionable security intelligence. Point it at any Loki instance. No SIEM subscriptions, no per-GB ingestion fees.

Read article →
2026-03-28 github automation ci-cd

How to Trigger GitHub Copilot Code Reviews Programmatically

The undocumented bot name, the silent failures, and the three working approaches for requesting Copilot code reviews from CI/CD pipelines and agentic workflows.

Read article →
2026-03-25 security kubernetes supply-chain

The LiteLLM Supply Chain Attack and Why Your Secrets Shouldn't Survive Boot

Yesterday's PyPI compromise of LiteLLM harvested every credential it could find on disk. Here's how ephemeral filesystem secrets via the Kubernetes Secrets Store CSI Driver reduce the blast radius of exactly this class of attack.

Read article →