Blog

Thoughts, tutorials, and insights on web development

Security
Inside MCP: What an MCP Server Is Made Of
2026-08-0521

Take away the vocabulary and an MCP server is a list of tools, a description of each written to be read by a machine, and two ways of delivering a message. Plus authorization, and three ways of failing — the third of which no specification can catch, and it cost me twelve published articles.

MCP
API
Architecture
Security
Authentication
Spec
AI
Blocking Unsafe Code: Security Audits in GitHub Actions
2025-09-017

Step-by-step guide to integrating bundler-audit, license_finder, and OSV Scanner into CI/CD pipelines — with YAML examples that block deployments until issues are fixed.

GitHub Actions
Ruby
Security
Supply Chain
DevSecOps
How RubyGems Protects Us From Supply Chain Attacks (And Why Every Ruby Developer Should Care)
2025-09-016

What happens behind the scenes during gem install: automated scanning, risk scoring, retroactive scanning, incident response — and why companies should support RubyGems critical infrastructure.

Ruby
RubyGems
Security
Supply Chain
DevSecOps
Keycloak and Identity Federation: A Comprehensive Guide
2024-09-0814

A comprehensive guide to Keycloak and identity federation, covering modern IAM, authentication functions, user experience, and security benefits.

Keycloak
Identity Federation
IAM
Authentication
Security
Understanding Realms, Clients, and Roles in Keycloak
2024-07-185

A comprehensive guide to understanding the core concepts of Keycloak: Realms, Clients, and Roles for effective identity and access management in your applications.

Keycloak
Authentication
IAM
Security
Identity Management