iamyi.net

iamyi.net is my personal profile site and a collection of my personal writings about security.

The content here is primarily focused on application security, cloud security, GenAI and ML security, security architecture, and related research notes.

Minibooks

Influence-first AI securityTrace influence and bound authority across models, harnesses, apps, and agents. GenAI & ML securityMinibook notes on securing GenAI and ML applications across the lifecycle. Security code reviewManual review skill, vulnerability patterns, and AI-assisted practice.

Essays

Security engineering practice

A systematic approach to product securityTurn shift-left ideals into repeatable product-security practice across phases and priorities. Security tasks and prioritizationHow capable engineers prioritize macro security work and micro risk signals. Security as coding intelligenceWhy AI-era development needs security as embedded rules and intentional friction. Guardrails and the security engineer’s roleFour security-engineer roles from observer to gatekeeper—and how much each steers delivery.

Mental models & threat modeling

From mental model to security modelMove from “how the system works” to “how it can fail” in reviews. Threat Modeling Case Study: Car Firmware Update via USB StickUSB firmware-update case study—structured threats beyond sign-and-encrypt. Understanding threats, vulnerabilities, and riskThreat, vulnerability, and risk as a usable mental model—not interchangeable labels.

Security code review

Security code review: trends and practice in the AI eraEvidence and operating model for LLM-assisted review without abandoning human judgment. Build security code review confidence: from uncertain to certainA path from ambiguous code to defensible review confidence.

GenAI / ML security

Study note — The Developer’s Playbook for Large Language Model SecurityPersonal study companion to Wilson’s LLM security playbook (not a substitute for the book). How-to: End-to-end ML model and GenAI application securityLifecycle checklist for securing ML and GenAI applications end to end. Study note — Prompt engineering (PE4LLM)Notes on prompt/context engineering—what LLMs do and do not “understand.”

Compliance & research

Research: China PIPL and U.S. PADFAA / DOJ DSP complianceWorking comparison of China PIPL and U.S. PADFAA / DOJ DSP for vendor and eng roles.

Templates

Template — Security architecture review documentReusable outline for application security architecture reviews.

Talks

Can LLMs do security code review?Invited deck on LLM-assisted review—help, limits, and where human judgment stays required. Compliance from the perspective of security (in plain words)Invited deck on explaining compliance in plain language from a security engineering view.

Incidents

2026-08-26 OpenAI–Hugging Face agent intrusionEval agents reused mirrors and dataset pipelines—facts, surfaces, and controls.

Whoami

WhoamiShort profile and how to interpret this site.

License

Unless otherwise noted, the original writing in this repository is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).

See https://creativecommons.org/licenses/by/4.0/ for the license terms.