Reykur BlogField notes from the
Field notes from the
frontier of threat modeling.
Research, product thinking, and stories from the trenches of building continuous threat modeling for the AI-era SDLC.
4,500 websites leaked their source code in 2024. Here's how many still do in 2026.
In 2024, Truffle Security counted 4,500 top-1M websites exposing their .git directory. We re-ran the measurement in 2026: 3,618 sites still serve theirs. Same bug, same one-line fix, fifteen years on.
Your AI coding assistant is quietly shipping your secrets
AI coding agents are leaving a new kind of paper trail in your codebase — configuration files, logs, and helper artifacts that were never meant to leave your laptop.