Writing

Everything we write down.

Articles, security advisories, release notes and short notes from the middle of a job. Written while it is still fresh, kept in one place. Filter by format or by subject.

The security log

Advisories and findings have their own log.

Vulnerabilities we disclosed to maintainers, and vulnerabilities we caught in client code before they shipped. The log is where they are complete: severity, CVSS, affected versions, remediation.

Open the security log

AdvisoryAgentic AI Framework Security: OpenClaw as a Case Study for Industry-Wide Standards25 FEB FindingOpenClaw Security Assessment14 FEB FindingAgenta Security Assessment13 JAN

2 advisories · 9 findings/devsec/advisories/ →

21 pieces, newest firstkolega.ai/blog/

28 MAY

2026

Article

We built 24 apps with AI. Three platforms. 561 vulnerabilities.

Eight app categories. Three platforms. Same brief on every one. 561 vulnerabilities later, here's what the data says about vibe coding.

9 min·Kolega.dev Team

21 APR

2026

Article

When SOC 2 Type II Compliant Means Anyone Can Read Your Source Code

Lovable spent 2025 turning security into a brand. Then a free account read everyone's chats, credentials, and code. Their response: That is intentional behaviour.

SAST·10 min·Jost

20 APR

2026

Article

Your "Won't Fix" Backlog Just Became a Zero-Day Catalogue

Anthropic's Mythos weaponised the "Won't Fix" backlog. Here's why chain disruption and not faster patching is the only defence that scales.

Mythos·11 min·Jost

15 APR

2026

Article

Vibe Coding Is Safe for Production When You Do These 6 Things

Six things make vibe coding production-ready: secret scanning, dependency verification, API-level auth testing, semantic analysis for business logic, automated scanning on every push, and security headers. Here's exactly how to set each one up.

Vibe Coding·11 min·Jost

9 APR

2026

Article

We Ran 15 Security Scanners Against Real Vulnerabilities. The Results Aren't Pretty

We tested 15 security scanners on 796 real vulnerabilities in 26 Python repos. SAST tools like Semgrep and Snyk caught less than 18%. LLMs like Claude Sonnet 4.6 caught 50%. Kolega.Dev caught 81%. All data, scoring code, and results are open-source at realvuln.kolega.dev.

SAST·11 min·Jost

31 MAR

2026

Article

The 8 Most Common Vulnerabilities in AI-Generated Code

45% of AI-generated code fails security tests. These 8 vulnerability patterns keep shipping in vibe-coded apps - and your SAST tools miss most of them.

AI Security·7 min·Jost

27 MAR

2026

Article

Your Security Scanner Was the Weapon: The TeamPCP Supply Chain Attack

On March 19, a routine Trivy scan stole your cloud credentials. Here's the full TeamPCP attack chain, why every detection tool missed it, and what to fix today.

supply chain security·11 min·John

21 MAR

2026

Article

Y Combinator Just Celebrated Building a Generation of Insecure Startups. Nobody Noticed.

Demo Day celebrated 95% AI-generated codebases. But 45% of AI code fails security tests, and traditional SAST can't catch it. Here's the math they skipped.

Vibe coding·11 min·Jost

Reading is cheaper than a failed cutover.

If something here lands close to what you're facing, the fastest next step is a conversation with the people who wrote it.

The research library