Our Server Got a Second Job: The Fourth of July Cryptominer
Even a security engineer can get pwned. How we traced a cryptominer consuming 12.5 CPU cores to a vulnerable Next.js app—and what the incident taught us about patching,…
11 min readQUENTIN MAYO / FIELD NOTES
Looking for something?
Search the notebook for a topic, a tool, or a passing thought.
Recent notes
AI Created My Security Backlog. Then AI Fixed It.
AI helped me build more software—and accumulate nearly 1,000 security findings. Then I put agents to work on the backlog. Here’s what I learned about remediation, independent verification,…
15 min readYou Probably Don’t Need the Cloud Yet
I have a love-hate relationship with cloud computing. Let me start by making something clear: I’m not anti-cloud. AWS is actually my default cloud provider. I use Route…
8 min readWhere Should the Compute Live? Lessons From 100+ Hours of AI-Assisted Development
This isn’t one of those posts where I’m going to tell you that I’ve figured out the perfect development environment. I haven’t. There isn’t even necessarily a winner…
13 min readHow to Insert the Date with a Keyboard Shortcut on a Mac
I type the date often enough that copying and pasting it every time became a nuisance. My preferred format is the compact, sortable ISO format: 2026-08-09 On a…
3 min readSetting up Safe-Settings on Coolify
A step-by-step guide to deploying GitHub Safe-Settings — policy-as-code for a GitHub organization — on a self-hosted Coolify instance. This guide reflects the live securelyprogramming deployment (app served…
4 min read