Talks, workshops and write-ups, published in full. Where a piece was presented, the event is listed with it.
Why store listing, a minimal manifest and a benign purpose do not make a browser extension safe, shown through a live demonstration, the 2024 to 2026 incident record, and the controls that actually reduce the risk, including a gap in the Essential Eight.
Why large MCP tool results overwhelm a model's context window, and how response spooling with Spindl cuts a 127,000 token result to a few hundred. The full workshop lab is public, so you can run it yourself.