Practitioner notes

Building, breaking, and securing the cloud.

Long-form notes on AWS, GCP, Azure, Kubernetes, compliance, and the engineering decisions pre-seed and seed founders face. New posts every Monday and Thursday.

RSS40 posts
DevSecOps

Best Fractional DevSecOps Providers in India (2026): What the AI Engines Actually Name

We asked ChatGPT, Gemini and Perplexity for the best fractional DevSecOps providers in India, then checked every company they named against its own homepage. Not one describes itself as fractional. Here is the raw data and how to shortlist properly.

8 min read·Aug 29, 2026
Cloud Security

Ransomware Resilience for Lean Teams: Immutable Backups, Tested Restores

Attackers go for the backups first. What S3 Object Lock, Vault Lock and a separate account actually buy a six-person team, and the restore drill that proves any of it works.

14 min read·Aug 27, 2026
Cloud Security

Post-Quantum in 2026: What Is Already On, and What Is Still Classical

Hybrid ML-KEM key exchange is already default in your browser, your CDN and your SSH. The parts nobody upgraded for you: origins, VPNs, certificates, code signing, data at rest.

14 min read·Aug 24, 2026
Compliance

SEBI CSCRF for Vendors: What Startups Selling to Market Entities Must Build

CSCRF binds SEBI Regulated Entities, not their vendors. But it reaches your startup through their contracts. The eight obligations that actually land on you, and what to build for each.

14 min read·Aug 20, 2026
FinOps

FinOps for AI Inference: Controlling GPU Spend on a Lean Team

Up to 90 percent of ML infrastructure spend is inference, not training. The 2026 playbook for lean teams: measure, batch, cache, autoscale, and buy capacity right.

13 min read·Aug 17, 2026
Cloud Security

The 47-Day Certificate: What Breaks and the Automation to Fix It

TLS certificate lifetimes are already down to 200 days and headed to 47. The full SC-081v3 schedule, what actually breaks, and the 2026 automation to fix it.

13 min read·Aug 13, 2026
Compliance

The EU Cyber Resilience Act: What Non-EU Startups Must Ship by September

The CRA reporting obligation starts 11 September 2026. What a startup in India, Singapore, the UAE, the US or the UK selling software into Europe needs working, and what can wait.

13 min read·Aug 10, 2026
Kubernetes

Kubernetes Security 2026: Stable Features From 1.32 to 1.36 to Turn On

Only the security features that reached stable between Kubernetes v1.32 and v1.36, plus the removals and the Ingress NGINX retirement that will break you.

13 min read·Aug 6, 2026
DevSecOps

Securing AI-Generated Code: A 2026 Pipeline Playbook for Lean Teams

Roughly 44 percent of AI code generation tasks introduce a risky vulnerability. Nine pipeline controls that scale without a matching increase in human review.

13 min read·Aug 3, 2026
Cloud Security

Bucket Namespace Hijacking: How Global S3, GCS and Azure Names Leak Data

Cloud bucket names live in a global pool and return to it on delete. How namespace hijacking works, the research that proved it, and the 2026 fixes for lean teams.

13 min read·Jul 30, 2026
DevSecOps

When the Scanner Is the Attack: Hardening CI/CD After Trivy and KICS

In 2026 attackers compromised Trivy and Checkmarx KICS and turned security scanners into credential stealers inside CI. What happened, and the pipeline controls lean teams should adopt now.

13 min read·Jul 27, 2026
Cloud Security

MCP Server Security in 2026: Why Every Agent Connector Is Untrusted

MCP connectors run inside your agent's trust boundary. In 2026, tool poisoning, rug pulls, and a systemic STDIO command-injection flaw made that dangerous. A hardening playbook for lean teams.

13 min read·Jul 23, 2026
Compliance

RBI IT Outsourcing Master Direction 2023: A CTO Implementation Guide

The RBI Master Direction on Outsourcing of IT Services binds NBFCs, banks, and their fintech partners. Here is what a CTO actually has to implement.

12 min read·Jul 20, 2026
Cloud Costs

Cloud Cost Anomaly Detection: A Free Pipeline with Cloud Custodian and Lambda

Native cloud alerts tell you the bill jumped but not which resource did it. Build a free open-source pipeline with Cloud Custodian and Lambda that detects, attributes, and acts.

12 min read·Jul 16, 2026
Cloud Security

Security Hub vs Sentinel vs SCC: Which One Wins for Pre-Seed

AWS Security Hub, Microsoft Sentinel, and GCP Security Command Center are three different product categories wearing one label. When each wins for a pre-seed team, and what to turn on first.

14 min read·Jul 13, 2026
Indian Fintech

Account Aggregator in 2026: Cloud Architecture Rules for Indian NBFCs

The Account Aggregator rail is now core financial plumbing in India. What generic guides miss: the cloud-architecture constraints it forces on any NBFC or fintech FIU. 8 that reshape your build.

13 min read·Jul 9, 2026
Indian Fintech

DigiLocker Integration Security: 5 Audit Checkpoints for Indian Fintech

DigiLocker is now core KYC plumbing for Indian fintech, and most integrations leak. The 5 checkpoints I check first: consent flow, token storage, data minimisation, signature verification, revocation.

12 min read·Jul 2, 2026
SOC 2

SOC 2 Type 1 vs Type 2 in 2026: Which One a SaaS Startup Should Pursue First

Type 1 attests control design at a point in time. Type 2 attests they actually worked over months. Which one a pre-seed or seed SaaS startup should chase first in 2026, and why most pick wrong.

13 min read·Jun 18, 2026
DevSecOps

Container Image Scanning Compared: Trivy vs Snyk vs Grype in 2026

A practitioner comparison of Trivy, Snyk, and Grype for container image scanning in 2026: database sources, scan scope, prioritization, CI wiring, the March 2026 Trivy supply chain attack, and what to pick by stage.

13 min read·Jun 8, 2026
IAM

AWS IAM Access Analyzer: The 6 Findings I See Most in Pre-Seed Accounts

IAM Access Analyzer is free, runs in minutes, and is ignored in most pre-seed AWS accounts. The six findings I see most often, what each one means, and how to fix or safely archive it in 2026.

13 min read·Jun 4, 2026
GCP

GCP Workload Identity Federation: How Startups Kill Static Keys

Static GCP service account keys are the credential most likely to leak your project. Workload Identity Federation removes them for GKE, CI/CD, AWS, and Azure. How it works in 2026.

12 min read·Jun 4, 2026
Kubernetes

Kubernetes Audit Log Analysis: 7 Patterns That Signal a Compromise

Seven Kubernetes audit-log patterns that signal a real compromise: what each looks like in the JSON, the audit fields to filter on, and the cheapest reliable detection for pre-seed and seed startups in 2026.

13 min read·May 26, 2026
DevSecOps

Terraform State for Startups: 5 Patterns and When Each Breaks at Scale

Terraform state goes wrong, you lose a weekend. Five state-management patterns for pre-seed and seed startups: what each is good for, where each breaks, and which fits your stage in 2026.

14 min read·May 23, 2026
Cloud Costs

Cloud Egress Costs in 2026: AWS vs GCP vs Azure for High-Traffic SaaS Startups

Egress is the line item high-traffic SaaS founders underestimate. AWS, GCP, and Azure all dropped exit fees in 2024 under the EU Data Act, but day-to-day egress still varies 10-40 percent. The honest 2026 breakdown with public pricing tables and six tactics to cut the bill.

17 min read·May 19, 2026
PCI DSS

PCI DSS 4.0 in 2026: The 9 Most-Missed Requirements for Pre-Seed Fintech CTOs

Most pre-seed and seed fintechs are still operating against PCI DSS 3.2.1 mental models. By May 2026 the 4.0 standard is fully in force. The 9 requirements I see startups miss most often, with engineering-level fixes and stage-specific guidance.

13 min read·May 19, 2026
AWS

AWS vs GCP for Indian Fintech: The 12 Decision Points No One Writes About

The standard AWS-vs-GCP comparisons miss the realities that matter for Indian fintech: RBI Data Localisation, India region maturity, hybrid connectivity to NPCI and banks, talent pool size, and Spanner vs Aurora for ledger systems. 12 honest verdicts grounded in production experience on both clouds.

14 min read·May 15, 2026
AWS

AWS S3 Block Public Access: Four Settings, What Each One Does, and Why You Need All Four

Most S3 breaches start with a checkbox flip, not a hacker. AWS shipped four settings called Block Public Access to fix that. This is the boring reference your team should read before configuring a bucket. Account level vs bucket level. Pre-2023 defaults vs post-2023 defaults. DPDP and RBI angles for Indian operators.

8 min read·May 12, 2026
Streaming Infrastructure

I Audited Five OTT Platforms With Browser Devtools. The Cache Headers Told a Story.

Three weeks of network-panel audits across five streaming platforms. Cache TTLs ranged from 5 minutes to nearly a year for the same kind of asset. Two of five shipped unsigned segment URLs. The accessibility gap was the most stark finding. What architecture choices reveal about the engineering culture behind each player.

11 min read·May 7, 2026
Compliance

What SOC 2 Actually Costs an Indian Seed Startup in 2026: A Line Item Breakdown

Indian seed-stage SaaS does SOC 2 Type II for ₹8-14 lakh all-in. The same opinion letter costs ₹34 lakh+ if you copy the Western default stack (Vanta + Big-4 + US pen test). Customers can't tell them apart. Here's the line-item breakdown grounded in 12+ Indian-market sources, not US enterprise aggregators.

13 min read·Apr 23, 2026
Cloud Cost

Ghost Hunter: The $28,000 Question Your Dashboard Won't Answer

Every cloud bill tells you what went up. None of them tell you why. Ghost-hunter is an AI investigator that reasons through your bill the way a senior SRE does: one hypothesis at a time, read-only, every command validated before it runs.

8 min read·Apr 19, 2026
Cloud Security

I Looked at 30 Startups' Infrastructure. Every Single One Had the Same Problem.

After reviewing 30 startups under 50 engineers, a pattern emerged: the CTO is doing everything, security is on nobody's plate, and one bad day is all it takes. Here are the 7 things I found in every single one.

6 min read·Apr 12, 2026
Compliance

RBI Compliance for Fintech Startups: Security Checklist 2026

A practical infrastructure checklist for fintech CTOs. Covers RBI cybersecurity framework, data localization, VAPT requirements, and the mistakes that trigger enforcement actions.

10 min read·Apr 5, 2026
Compliance

DPDP Act Compliance for Startups: What Your Dev Team Needs to Build Before May 2027

DPDP Act enforcement starts May 2027. Here is exactly what your startup needs to build, with penalties up to INR 250 crore for non-compliance.

9 min read·Apr 5, 2026
AWS Security

AWS IAM Audit for Startups: A Step-by-Step Guide to Finding and Fixing Risky Permissions

Learn how to run a practical AWS IAM audit for your startup, find overprivileged roles, and fix the misconfigurations that lead to breaches.

5 min read·Mar 26, 2026
Cloud Cost

Cloud Cost Optimization for Startups: Cut AWS Bills Fast

A practical guide for startup engineers to reduce cloud spend using proven cost optimization techniques that do not sacrifice performance.

4 min read·Mar 26, 2026