Secure Steps · field notes by Daniel Begimher
Field notes from the frontier of AI security.
An engineer building, breaking, and evaluating AI security systems — writing the practical version in public. Agents, prompt injection, RAG, evaluation, and developer-first tooling.
Four paths in
Clear routes for first-time visitors — no empty archives, no guessing.
AI Security
Agent evaluation, prompt injection, RAG security, GenAI threat modeling, and AI Leak Watch.
Cloud & AppSec
Secure SDLC, AWS security, CI/CD, container security, and AppSec programs.
Tools & Research
ASH, AI Leak Watch, SIR-Bench, publications, and talks gathered into one index.
Career Guidance
Beginner-friendly security career advice grounded in real proof of work.
Built & measured
Public-safe work across AI security, open source, and applied research.
Automated Security Helper
One CLI command runs SAST, SCA, IaC, secret, and SBOM scanners — nine open-source tools across your code, dependencies, containers, and infrastructure, in local dev or CI/CD.
200k+ monthly clones · 650+ GitHub stars
SIR-Bench
An open benchmark that tests whether an AI incident-response agent actually investigates — finding new evidence and using tools — instead of just rephrasing the alert. Published on arXiv.
ThreatForest
Agentic attack trees from source code, mapped to MITRE ATT&CK techniques, with mitigations for review. Selected for a Black Hat USA 2026 briefing.
AI Leak Watch
Public dashboard tracking potentially exposed AI provider keys and AI-era secret leakage risk.
Latest field notes
It’s 2025. Why Are We Still Pushing API Keys to GitHub?
Why hardcoded AI keys keep leaking, why agents widen the blast radius, and how teams should respond.
Building Your Cybersecurity Career Path
A practical guide for beginners: choose a path, learn deeply, build visible proof of work.
Subscribe
Get the next practical security lesson.
For builders and security teams working through AI security, cloud security, AppSec, open-source tooling, and career growth.
// no employer endorsement implied — opinions are my own