https://sachinsmc.me/blog/tags/security/ Recent content in Security on Sachin Chavan Hugo en-us Mon, 22 Jun 2026 12:00:00 +0400 https://sachinsmc.me/blog/posts/fake-web3-job-rce-malware/ Mon, 22 Jun 2026 12:00:00 +0400 https://sachinsmc.me/blog/posts/fake-web3-job-rce-malware/ A LinkedIn ‘investor’ offered me a $70-120/hr Web3 job and sent a ‘skill assessment’ repo with a 2-3 hour deadline. The moment its server boots, it fetches code from an attacker’s machine and runs it with full Node.js privileges. I recognized the trap, told him I’d run it (I hadn’t), and handed him back his own command-and-control link. Here is the full teardown. https://sachinsmc.me/blog/posts/multi-tenant-rag-authorization-boundary/ Sat, 20 Jun 2026 12:00:00 +0400 https://sachinsmc.me/blog/posts/multi-tenant-rag-authorization-boundary/ In a single-tenant RAG you trust the index. In a multi-tenant one, a shared index plus one missing filter leaks Tenant A’s documents into Tenant B’s answer. Here is the unified mental model that ties the metadata-filtering mechanics and the authorization layer together, treat the tenant filter as a policy decision, not app code, with the same architecture mapped across AWS, Azure, and Google Cloud (diagrams and Python included).