Notes from the work
Security findings, WordPress internals, QA practice and what I learn building software with AI-assisted pipelines.
-
Security Lead Time: The Advantage of Working With a Developer Who Finds Vulnerabilities
There are 15 Divi vulnerabilities documented by Wordfence. Six of them are mine, and the most recent one was published yesterday. The number is not the interesting part. What matters is the window between finding a vulnerability and everyone else learning it exists, and who is standing in that window with you.
Read the article -
Yes, I Have 100. But It's Just Text, Right?
Four greens on mobile, and the reply is always some version of "sure, but your site barely does anything." Correct. That is not the loophole in the score, it is the entire method: the site's purpose decides the stack, not the other way around.
Read the article -
AI Made QA More Important, Not Less
Production was never the bottleneck in quality. Verification was. Fluency used to be a weak proxy for care; it is now a proxy for nothing at all, and a model checking its own output is not an independent control.
Read the article -
Assume Error: What Creative QA Can Learn From Cybersecurity
Security stopped designing systems around perfect behavior decades ago. Creative QA still assumes the person making the work will get it right. A defect and an escaped defect are not the same event.
Read the article -
Your Best Performer Should Be a Laboratory, Not a Weapon
The difference is almost never talent. It is a private control: undocumented, invented by them, run every single time, and completely wasted as long as it lives in one person's head.
Read the article -
A Blame-Free Culture Is Not an Accountability-Free Culture
One incorrect price has at least five different causes, and only one of them is a performance problem. You are not accountable for being fallible. You are accountable for the controls you agreed to run.
Read the article -
A Critical Defect Caught Internally Is a Win
Two things happened, and only one of them is interesting. A CQIS 9 at E1 is not a report of a near-disaster. It is a measurement of how much the control was worth.
Read the article -
From QA Checklist to Creative Risk Management
CQIS, the Creative Quality Impact Score: five dimensions scored 0 to 2 for potential impact, five escape levels for how far it got, and a rule that the two are never collapsed into one number.
Read the article -
Metrics Can Destroy the Culture They Were Designed to Improve
Nobody deletes findings. It fails through a hundred small, individually defensible judgment calls, and the dashboard improves the whole time. Accountability without safeguards eventually becomes blame with better metrics.
Read the article -
No Rate Without a Denominator
Jane made 10,000 assets and had 15 findings. John made 10 and had 2. The raw counts say Jane has a problem. The rates say the opposite, by a factor of 130, and John's rate is not really a rate at all.
Read the article -
Not Every Typo Is Low Severity
The defect is not the impact. Five questions (materiality, exposure, trust, reversibility and business consequence) that tell a missing comma apart from a wrong date in an email already sent to 40,000 people.
Read the article -
Red-Team the Work, Not the People
Good security testing and good QA begin with the same question: what are we assuming will always be true? Then you systematically make those assumptions false: in a checkout flow, and in a card that has only ever rendered short names.
Read the article -
Security and Quality Are Like an Onion
Donkey's objection is the good one: plenty of things have layers, cake has layers. What makes onion layers different is that they fail independently, and that is the whole of defense in depth. Index to the thirteen-article series.
Read the article -
Stop Counting Mistakes. Start Measuring Escapes
Team A found 100 defects and five escaped. Team B found 10 and six escaped. The number that should alarm you is not 100. It is 63%.
Read the article -
The Trust Chain: Why Creative Errors Get More Expensive as They Travel
Creator, team, agency, client, the client's customer, the public. The defect does not change as it crosses those boundaries. What changes is who absorbs it, and whether the cost is still measured in minutes or already in confidence.
Read the article -
When Does a Mistake Become a Pattern?
Two defects are not a pattern because they are two defects. They are a pattern when they share a class, a window fixed in advance, and a denominator. A recurrence metric is an alert, not a verdict.
Read the article -
The WordPress SVG Security Gap Nobody Is Incentivized to Report
An SVG is not just an image. It is an XML document that can carry scripts. WordPress has no Core sanitizer, plugins enable uploads anyway, and the reporting programs that would flag it consider the whole class out of scope.
Read the article