Blog

In Defense of Friction

Fri, 13 Feb 2026 00:00:00 +0000

Lessons from a Month of Vibe Coding with Copilot CLI

Sun, 11 Jan 2026 00:00:00 +0000

One of the greatest perks to working at GitHub is unlimited access to Copilot tokens, allowing me to vibe code as much as I want:

With my unlimited AI, I spent most of my holiday break vibe coding up small utilities and games that I’d wanted to work on before but never had the time to finish.

Here are a few lessons that a holiday season with irresponsible access to premium models taught me about vibe coding with Copilot CLI:

How GitHub's Agentic Security Principles Make Our AI Agents as Secure as Possible

Tue, 25 Nov 2025 00:00:00 +0000

Self Advocacy at a Remote-First Company: How to Careermax

Fri, 07 Nov 2025 00:00:00 +0000

Over the past couple of years at GitHub, I’ve learned that nothing in corporate is handed to you; you should always be your own biggest advocate. Promotions, good projects, and visibility are only unlocked when you have eyes on you. As they say, only the squeaky wheel gets grease.

Getting visibility is never easy, but it can be even more difficult at a remote-first company where it’s harder to physically network. However, by being tactical and intentional, you can still maximize your impact and visibility. Here are the five things I focus on to make that happen at GitHub.

How Reversible are Embeddings: Embedding Inversions and How to Protect your Data

Mon, 27 Oct 2025 00:00:00 +0000

I was recently asked to determine the sensitivity of embeddings generated from proprietary code. While it seemed natural to think that embeddings were one-way functions that could not be reversed, research revealed that substantial semantic leakage was possible—even if direct reconstruction was not.

Embeddings turn a token—a word, subword, or symbol— into a vector that encodes its semantic meaning. However, these vectors are not unique; multiple tokens can map to the same vector, and as such are a lossy function. Embeddings generated from longer sequences, like sentences or paragraphs, lose even more data, as the sequence embedding techniques compress more information into the same vector space, leading to even more collisions, like squishing a bunch of different photos into a single blurry thumbnail.

Prompt Injection is a Weakness, not a Vulnerability

Thu, 15 May 2025 00:00:00 +0000

Prompt injection is the most widely discussed emergent threat for Large Language Models (LLMs). But how should organizations approach tracking and prioritizing it?

In my opinion, instead of being a vulnerability in and of itself, prompt injection is a weakness that leads to other, more potent vulnerabilities. While it is true that prompt injection is undesirable, it doesn’t necessarily lead to any business value compromises and is also (at the time of writing) unsolvable. As such, it is better to treat it as a necessary side effect of using LLMs, architect around it, and not track it as a distinct vulnerability.

Secure Generative UIs with Grammar Constrained Decoding

Tue, 29 Apr 2025 00:00:00 +0000

LLMs are very powerful for generating arbitrary text, but they really shine when you ask them to generate structured output. One such use case is generating rich UIs and text.

It’s much easier to read the output of an LLM if it’s properly styled and interactive. Reading large blobs of text can get unwieldy, and adding styling and interactive elements dynamically makes the output much more user-friendly and personalizable. This is known as a Generative UI; a User Interface that is generated in real-time by a generative AI.

Writing in the Age of AI: My AI-enabled Process for Writing

Tue, 04 Mar 2025 00:00:00 +0000

Is writing a dying art in the ChatGPT era? How I think about using AI in my writing and my AI-enabled process.

LLMs have decimated the role of a professional writer. We’ve seen layoffs among translators, journalists, paralegals; many job fields for which writing is the core responsibility have either been completely obviated or are on their way there in due course. Even as an engineer, I’ve been able to increase my writing efficiency almost to the order of 0.5 FTE— reports and other prose that I might’ve previously needed another engineer to help with, I’m able to do alone in half the time and twice as well.

Path to SOC Analyst: Breaking into Cybersecurity

Sun, 23 Feb 2025 00:00:00 +0000

This was originally drafted as a Google doc for a friend.

If you’re trying to break into cybersecurity with no previous cyber, engineering, or IT experience, the best way to break into the industry is as a SOC analyst.

SOC Analysts are cybersecurity analysts responsible for monitoring corporate networks for potential threats and intrusions. While certainly not an introductory IT/ engineering role, it is the closest thing to an introductory role in security.

Being Intentional in 2024

Mon, 22 Jan 2024 00:00:00 +0000

I put on quite a bit of weight over COVID. Stuck in lockdown with little else to do, I quickly picked up a nasty habit of snacking. The cupboard and fridge were so accessible and readily stocked with all manner of tasty food. With nothing better to do, I would go grab a bite anytime I was hungry or bored or thirsty or anything. And of course, with all of this, I began to balloon in weight, despite wanting to remain healthy.

Introduction to Natural Language Processing

Thu, 21 Sep 2023 00:00:00 +0000

A quick intro to the basic terminology and concepts in Natural Language Processing.

Token

A token is the smallest semantic subsection of a piece of text. For example, a word.

This is the smallest subdivision of a text that can be assigned meaning (any smaller units than a word, like individual letters, have no inherent meaning to them)

n- gram

An n- gram is a collection of n tokens. For example, if we’re using words as the gram and using the value 2 as n, in the sentence:

"for … in" vs "for … of" in JavaScript

Sun, 17 Sep 2023 00:00:00 +0000

TIL that for … in and for … of have different behaviors in JavaScript.

As a native Python developer, I had presumed that for … in in JavaScript would have a similar behavior to the equivalent in Python. However, they have very different behaviors. See below:

TLDR

JavaScript	Python
`for (foo in [])`	`for i in range([])`
`for (foo of [])`	`for i in []`

Details

for … in iterates over the keys of a particular object, whereas for … of iterates over the values of the object. It does this by using an iteration protocol.

Introduction to Adversarial AI

Mon, 03 Apr 2023 00:00:00 +0000

The following is a transcription of a talk I’ve given internally at GitHub. The talk, and slides, are about the basics of adversarial AI, and how it can be used to attack machine learning models.

Slides

Transcript

How do Machine Learning Systems work?

For the purposes of this talk/ blog post, we’re not going to go too in depth into the technical details of machine learning algorithms. However, from a security perspective, it is important to note the flow of data.

Implementing a Robust Digital Identity

Fri, 10 Jun 2022 00:00:00 +0000

Setting Secure Hashing Parameters for Password Hashing

Sat, 28 May 2022 00:00:00 +0000

TLDR: As of May 2022, I’d recommend using Argon2Id with the parameters recommended in RFC 9106

When trying to select the right way to protect your user’s passwords and credentials, there’s two things we need to consider. Firstly, we need to choose the right algorithm, one that is cryptographically secure. Secondly, we need to se the right parameters for the given algorithm to make it behave as securely as possible.