Building, breaking,
and securing the cloud.
Long-form notes on AWS, GCP, Azure, Kubernetes, compliance, and the engineering decisions pre-seed and seed founders face. New posts every Monday and Thursday.
The Security Questionnaire Gauntlet: Answering Vendor Reviews as a Small Team
SIG, CAIQ, MAS Notice 658 and DORA registers. What enterprise and regulated buyers actually ask a six-person startup, how to answer honestly, and how to stop rebuilding answers every time.
AI Search Visibility for Startups: How ChatGPT and Gemini Decide Who to Name
13 min·Aug 29, 2026Engineers Spend More Time Fixing Deployments Than Building: What Teams Actually Do
8 min·Aug 29, 2026No DevOps Person, and Production Keeps Breaking at Night: What Are the Options?
9 min·Aug 29, 2026Our AWS Bill Doubled and Nobody Knows Why: A Triage Runbook
9 min·Aug 29, 2026Best Fractional DevSecOps Providers in India (2026): What the AI Engines Actually Name
We asked ChatGPT, Gemini and Perplexity for the best fractional DevSecOps providers in India, then checked every company they named against its own homepage. Not one describes itself as fractional. Here is the raw data and how to shortlist properly.
8 min read·Aug 29, 2026Ransomware Resilience for Lean Teams: Immutable Backups, Tested Restores
Attackers go for the backups first. What S3 Object Lock, Vault Lock and a separate account actually buy a six-person team, and the restore drill that proves any of it works.
14 min read·Aug 27, 2026Post-Quantum in 2026: What Is Already On, and What Is Still Classical
Hybrid ML-KEM key exchange is already default in your browser, your CDN and your SSH. The parts nobody upgraded for you: origins, VPNs, certificates, code signing, data at rest.
14 min read·Aug 24, 2026SEBI CSCRF for Vendors: What Startups Selling to Market Entities Must Build
CSCRF binds SEBI Regulated Entities, not their vendors. But it reaches your startup through their contracts. The eight obligations that actually land on you, and what to build for each.
14 min read·Aug 20, 2026FinOps for AI Inference: Controlling GPU Spend on a Lean Team
Up to 90 percent of ML infrastructure spend is inference, not training. The 2026 playbook for lean teams: measure, batch, cache, autoscale, and buy capacity right.
13 min read·Aug 17, 2026The 47-Day Certificate: What Breaks and the Automation to Fix It
TLS certificate lifetimes are already down to 200 days and headed to 47. The full SC-081v3 schedule, what actually breaks, and the 2026 automation to fix it.
13 min read·Aug 13, 2026The EU Cyber Resilience Act: What Non-EU Startups Must Ship by September
The CRA reporting obligation starts 11 September 2026. What a startup in India, Singapore, the UAE, the US or the UK selling software into Europe needs working, and what can wait.
13 min read·Aug 10, 2026Kubernetes Security 2026: Stable Features From 1.32 to 1.36 to Turn On
Only the security features that reached stable between Kubernetes v1.32 and v1.36, plus the removals and the Ingress NGINX retirement that will break you.
13 min read·Aug 6, 2026Securing AI-Generated Code: A 2026 Pipeline Playbook for Lean Teams
Roughly 44 percent of AI code generation tasks introduce a risky vulnerability. Nine pipeline controls that scale without a matching increase in human review.
13 min read·Aug 3, 2026Bucket Namespace Hijacking: How Global S3, GCS and Azure Names Leak Data
Cloud bucket names live in a global pool and return to it on delete. How namespace hijacking works, the research that proved it, and the 2026 fixes for lean teams.
13 min read·Jul 30, 2026When the Scanner Is the Attack: Hardening CI/CD After Trivy and KICS
In 2026 attackers compromised Trivy and Checkmarx KICS and turned security scanners into credential stealers inside CI. What happened, and the pipeline controls lean teams should adopt now.
13 min read·Jul 27, 2026MCP Server Security in 2026: Why Every Agent Connector Is Untrusted
MCP connectors run inside your agent's trust boundary. In 2026, tool poisoning, rug pulls, and a systemic STDIO command-injection flaw made that dangerous. A hardening playbook for lean teams.
13 min read·Jul 23, 2026RBI IT Outsourcing Master Direction 2023: A CTO Implementation Guide
The RBI Master Direction on Outsourcing of IT Services binds NBFCs, banks, and their fintech partners. Here is what a CTO actually has to implement.
12 min read·Jul 20, 2026Cloud Cost Anomaly Detection: A Free Pipeline with Cloud Custodian and Lambda
Native cloud alerts tell you the bill jumped but not which resource did it. Build a free open-source pipeline with Cloud Custodian and Lambda that detects, attributes, and acts.
12 min read·Jul 16, 2026Security Hub vs Sentinel vs SCC: Which One Wins for Pre-Seed
AWS Security Hub, Microsoft Sentinel, and GCP Security Command Center are three different product categories wearing one label. When each wins for a pre-seed team, and what to turn on first.
14 min read·Jul 13, 2026Account Aggregator in 2026: Cloud Architecture Rules for Indian NBFCs
The Account Aggregator rail is now core financial plumbing in India. What generic guides miss: the cloud-architecture constraints it forces on any NBFC or fintech FIU. 8 that reshape your build.
13 min read·Jul 9, 2026DigiLocker Integration Security: 5 Audit Checkpoints for Indian Fintech
DigiLocker is now core KYC plumbing for Indian fintech, and most integrations leak. The 5 checkpoints I check first: consent flow, token storage, data minimisation, signature verification, revocation.
12 min read·Jul 2, 2026SOC 2 Type 1 vs Type 2 in 2026: Which One a SaaS Startup Should Pursue First
Type 1 attests control design at a point in time. Type 2 attests they actually worked over months. Which one a pre-seed or seed SaaS startup should chase first in 2026, and why most pick wrong.
13 min read·Jun 18, 2026Container Image Scanning Compared: Trivy vs Snyk vs Grype in 2026
A practitioner comparison of Trivy, Snyk, and Grype for container image scanning in 2026: database sources, scan scope, prioritization, CI wiring, the March 2026 Trivy supply chain attack, and what to pick by stage.
13 min read·Jun 8, 2026AWS IAM Access Analyzer: The 6 Findings I See Most in Pre-Seed Accounts
IAM Access Analyzer is free, runs in minutes, and is ignored in most pre-seed AWS accounts. The six findings I see most often, what each one means, and how to fix or safely archive it in 2026.
13 min read·Jun 4, 2026GCP Workload Identity Federation: How Startups Kill Static Keys
Static GCP service account keys are the credential most likely to leak your project. Workload Identity Federation removes them for GKE, CI/CD, AWS, and Azure. How it works in 2026.
12 min read·Jun 4, 2026Kubernetes Audit Log Analysis: 7 Patterns That Signal a Compromise
Seven Kubernetes audit-log patterns that signal a real compromise: what each looks like in the JSON, the audit fields to filter on, and the cheapest reliable detection for pre-seed and seed startups in 2026.
13 min read·May 26, 2026Terraform State for Startups: 5 Patterns and When Each Breaks at Scale
Terraform state goes wrong, you lose a weekend. Five state-management patterns for pre-seed and seed startups: what each is good for, where each breaks, and which fits your stage in 2026.
14 min read·May 23, 2026Cloud Egress Costs in 2026: AWS vs GCP vs Azure for High-Traffic SaaS Startups
Egress is the line item high-traffic SaaS founders underestimate. AWS, GCP, and Azure all dropped exit fees in 2024 under the EU Data Act, but day-to-day egress still varies 10-40 percent. The honest 2026 breakdown with public pricing tables and six tactics to cut the bill.
17 min read·May 19, 2026PCI DSS 4.0 in 2026: The 9 Most-Missed Requirements for Pre-Seed Fintech CTOs
Most pre-seed and seed fintechs are still operating against PCI DSS 3.2.1 mental models. By May 2026 the 4.0 standard is fully in force. The 9 requirements I see startups miss most often, with engineering-level fixes and stage-specific guidance.
13 min read·May 19, 2026AWS vs GCP for Indian Fintech: The 12 Decision Points No One Writes About
The standard AWS-vs-GCP comparisons miss the realities that matter for Indian fintech: RBI Data Localisation, India region maturity, hybrid connectivity to NPCI and banks, talent pool size, and Spanner vs Aurora for ledger systems. 12 honest verdicts grounded in production experience on both clouds.
14 min read·May 15, 2026AWS S3 Block Public Access: Four Settings, What Each One Does, and Why You Need All Four
Most S3 breaches start with a checkbox flip, not a hacker. AWS shipped four settings called Block Public Access to fix that. This is the boring reference your team should read before configuring a bucket. Account level vs bucket level. Pre-2023 defaults vs post-2023 defaults. DPDP and RBI angles for Indian operators.
8 min read·May 12, 2026I Audited Five OTT Platforms With Browser Devtools. The Cache Headers Told a Story.
Three weeks of network-panel audits across five streaming platforms. Cache TTLs ranged from 5 minutes to nearly a year for the same kind of asset. Two of five shipped unsigned segment URLs. The accessibility gap was the most stark finding. What architecture choices reveal about the engineering culture behind each player.
11 min read·May 7, 2026What SOC 2 Actually Costs an Indian Seed Startup in 2026: A Line Item Breakdown
Indian seed-stage SaaS does SOC 2 Type II for ₹8-14 lakh all-in. The same opinion letter costs ₹34 lakh+ if you copy the Western default stack (Vanta + Big-4 + US pen test). Customers can't tell them apart. Here's the line-item breakdown grounded in 12+ Indian-market sources, not US enterprise aggregators.
13 min read·Apr 23, 2026Ghost Hunter: The $28,000 Question Your Dashboard Won't Answer
Every cloud bill tells you what went up. None of them tell you why. Ghost-hunter is an AI investigator that reasons through your bill the way a senior SRE does: one hypothesis at a time, read-only, every command validated before it runs.
8 min read·Apr 19, 2026I Looked at 30 Startups' Infrastructure. Every Single One Had the Same Problem.
After reviewing 30 startups under 50 engineers, a pattern emerged: the CTO is doing everything, security is on nobody's plate, and one bad day is all it takes. Here are the 7 things I found in every single one.
6 min read·Apr 12, 2026RBI Compliance for Fintech Startups: Security Checklist 2026
A practical infrastructure checklist for fintech CTOs. Covers RBI cybersecurity framework, data localization, VAPT requirements, and the mistakes that trigger enforcement actions.
10 min read·Apr 5, 2026DPDP Act Compliance for Startups: What Your Dev Team Needs to Build Before May 2027
DPDP Act enforcement starts May 2027. Here is exactly what your startup needs to build, with penalties up to INR 250 crore for non-compliance.
9 min read·Apr 5, 2026AWS IAM Audit for Startups: A Step-by-Step Guide to Finding and Fixing Risky Permissions
Learn how to run a practical AWS IAM audit for your startup, find overprivileged roles, and fix the misconfigurations that lead to breaches.
5 min read·Mar 26, 2026Cloud Cost Optimization for Startups: Cut AWS Bills Fast
A practical guide for startup engineers to reduce cloud spend using proven cost optimization techniques that do not sacrifice performance.
4 min read·Mar 26, 2026