If you followed the wave of supply-chain attacks from the first half of 2026, you’ve probably realised that continuously patching and upgrading your dependencies is no longer optional.
For me, Renovate handles the patching part well.
Most bumps are safe, but majors, 0.x jumps, dead dependencies, and quietly deprecated framework configs are hard to spot from a CI test.
Manually reviewing every PR with the same rigor also doesn’t scale, and is a waste of time, to be honest.
CloudSecList just shipped a redesigned landing page.
Claude Design did the mockups. Claude Code wrote most of the code for Jekyll. I did everything in between, which turned out to be most of the actual work.
Claude Code ships with a capable baseline. After months of daily use across a multi-project monorepo, my default install has grown into something that looks less and less like the box it came in.
Rather than dump a big settings.json and hope it’s useful, I want to walk through my own setup.
Security Questionnaires. A lot has been written on them. (One of my favourites is Answering “Dumb Security Questionnaires”.)
Every security team I’ve worked with agrees on one thing: these are a massive time sink. Everyone wants to “automate” them, but what does that even mean in practice? You can’t deterministically automate inputs written in natural language.
“Do you remember that tool you shared six months ago? What was its name?”
I get this question constantly, and it makes sense. After six+ years of curating cloud security knowledge through CloudSecList (launched in 2019 ) and CloudSecDocs (which followed in 2020 ), I’ve built a vast knowledge base that’s become challenging to navigate.
So I had an idea: What if you could actually chat with your newsletter?
