Originally published at ewright3.com In January 2024, the SEC's official X account was hijacked. Attackers posted a fake Bitcoin ETF approval announcement, briefly moving markets. The Securities and Exchange Commission, the agency that writes the rules on public company cybersecurity disclosures, couldn't protect its own phone number. The compromise mechanism was a SIM swap. No sophisticated explo
Every AI app I've shipped recently rewrote the same plumbing. The OAuth dance for Slack. Encrypted storage for an API key. Refresh-token logic that finally fails on the 3rd call after an hour. Wiring up an MCP client to a server behind a bearer token someone pasted into a Notion page.