I’m Ali, a security engineer in Berlin.
This is my personal blog: notes from the work, things I’m learning, and ideas I keep coming back to. I write about DevSecOps and CI/CD, threat modeling, and cloud and supply-chain security.
Featured
Triage by Probability: Using Jev to Prioritize SCA Findings
A practical design for combining deterministic SCA enrichment with Jev's calibrated judgments—and validating the probabilities before using them to prioritize findings.
The Security Engineer's Survival Kit for the AI Era
A practical guide to the skills, workflows, and judgment security engineers need to work effectively and safely in the AI era.
The Part Everyone Misses in Supply Chain Vulnerability and SBOM Management
The 80% of supply chain security that lives in component identity, exploitability inference, and artifact integrity — and why the standard SBOM-plus-CVE-dashboard barely touches the actual risk.
Latest posts
All posts- 7 min read
LLMs in SAST: Good, Bad, Costly
Where LLMs actually help in static analysis — triage, explanations, and hybrid recall/precision — and where they hallucinate, drift, and quietly burn money at scale.
- 8 min read
From DSN to Shell: How a Leaked Sentry Key Becomes RCE Through Your AI Agent
A walk through indirect prompt injection at the tool boundary — why 'fix my Sentry issues' is a more dangerous instruction than it looks, and how to make it safe.
Latest talks
All talks- 4 min read
OWASP Berlin 2025 - Patch What Matters - Rethinking Vulnerability Prioritization
Speaking at OWASP Berlin Meetup about a topic that's been causing massive pain for security teams everywhere, vulnerability alert fatigue and how we can fix it with smarter prioritization
- 2 min read
WeAreDev 2024 - Real-World Threat Modeling
Speaking at WeAreDev 2024 about real-world threat modeling practices and methodologies