标签：#Security

Tu agente de código lee tu workspace. Un archivo envenenado en cualquier rincón puede llevar instrucciones que el agente ejecuta. ¿Sabes qué fracción de tu workspace tiene que leer para que eso ocurra? topowatch mide eso. El problema no es el prompt, es la topología El paper Workspace Topology as an Attack Vector in Agentic Coding Assistants (arXiv:2608.14876, Day et al., 2026) demostró algo que intuíamos pero no medíamos: la topología del workspace afecta mediblemente el Attack Success Rate (ASR) de la inyección indirecta. Los entornos altamente modulares muestran ASR significativamente menor que los planos. La razón es mecánica: si el agente acota su lectura al módulo de la tarea, nunca llega al archivo envenenado. Si hace un wide read de todo el workspace, lo lee siempre. Qué es topowatch topowatch es una herramienta de línea de comandos que, dado un workspace, mide el ASR de una inyección indirecta de referencia bajo varias configuraciones de topología, y reporta qué estructura minimiza el ASR. Fundamentado en arXiv:2608.14876. Determinista y reproducible sin claves ni red: usa un agente sintético configurable y un fixture con tres topologías (monolito, modular, nesting profundo). pip install -e ".[test]" topowatch --json Resultados Sobre el fixture de referencia (200 trials, semilla fija): Topología ASR % leído Monolito (plano) 1.000 100% Modular (acotado) 0.000 28.5% Nesting profundo 0.000 66.6% El reporte incluye read_budget (fracción del workspace que lee el agente) y el veredicto del defense contract: modular < monolito . Honestidad sobre v0.1 v0.1 usa un agente sintético , no un coding assistant real (Claude Code / Codex). El claim "modularidad → ASR menor" está anclado al fixture reproducible, no a una medición contra un assistant real — eso es v0.2 (feature 002). El objetivo de v0.1 es darte una herramienta para medir y recomendar modularidad, no simular un ataque completo. Roadmap v0.2 : medición contra coding assistants reales (sandbox, sin credenciale

Photo by Steve A Johnson on Unsplash TL;DR: Use this concise checklist to spot a compromised AI account, verify the intrusion, and lock down the breach before it spreads. When ChatGPT, Midjourney, or any other generative AI becomes the backbone of your product, a silent intrusion can steal prompts, expose proprietary models, and inflate cloud bills. Recent reports show credential‑theft campaigns targeting AI developers at a record pace. The good news? Most breaches leave subtle breadcrumbs. Spotting them early can stop damage in its tracks. Red flags that scream “someone’s in your AI sandbox” Logins from unfamiliar locations or devices – Most platforms surface a recent‑activity panel. If you see IP addresses or time zones that don’t match your normal pattern, treat it as a warning. Sudden surge in token usage or API calls – A spike in request volume, especially outside business hours, often indicates an automated script harvesting your quota. New API keys or secret tokens you didn’t create – Check the keys list; any entry without a clear owner should be revoked immediately. Unexpected projects, datasets, or fine‑tuned models – Hackers may spin up their own workspaces to hide malicious prompts or upload malicious data. Altered prompt histories or output logs – Look for prompts that contain strange instructions, phishing language, or data‑exfiltration attempts. Billing alerts or unexplained charges – A rogue actor can run expensive GPU jobs, inflating your monthly invoice. Security‑related emails you never requested – Password‑reset or MFA‑enable notifications you didn’t trigger often signal someone probing your account. If any of these symptoms appear, move to verification before panicking. Verify the breach – a step‑by‑step audit Pull the login audit – Export the recent‑login CSV (most services let you download it). Cross‑reference timestamps, IP ranges, and device types with your internal logs. Scrutinize API activity – Filter the request log for endpoints you rare

There is a comforting story about how AI models handle the enormous quantities of text and images they are trained on: they do not store any of it, they merely learn general patterns, and once training is done the original data is gone in any meaningful sense. It is a reassuring account, and it is not quite true. Large models memorise fragments of their training data — verbatim, recoverable fragments — and a decade of research has produced reliable ways to detect and extract them. The answer-first version: if your data was in a model’s training set, the model may have memorised identifiable pieces of it, and those pieces can leak. Two families of attack make this concrete. Membership inference works out whether a specific record was in the training data at all. Data extraction pulls memorised content back out word-for-word. Neither is exotic; both are well documented against production systems. This is the mechanism underneath both the newspaper lawsuits alleging near-verbatim reproduction of their articles and the quieter privacy research showing that models leak the people in their training sets. Understanding it is the difference between trusting the comforting story and knowing its limits. Memorisation is a feature of the maths, not a bug Start with why models memorise at all. A large neural network has an enormous number of parameters — enough capacity to do more than compress general patterns. During training it is rewarded for predicting its training data accurately, and one very effective way to predict a specific example accurately is to memorise it. For data that appears once in an unusual form, or many times in an identical form, memorisation is often the path of least resistance for the optimiser. This is measurable. Researchers can show that a model assigns systematically higher confidence, and lower prediction error, to examples it was trained on than to otherwise-similar examples it has never seen. The size of that gap grows with the size of the model

Cybersecurity is everyone's business as long as you use the internet in one form or the other. Your job might be to develop the next cutting-edge security tools, raise people's cybersecurity awareness, and so on. And, in some cases, resolve to physically damage your infrastructure to stop an intrusion or minimize the impact. The list can go on. The point is to do your best wherever you might find yourself. Windows 11’s strongest security defenses can be bypassed without a screwdriver The title got me laughing. Still, do not panic. The attack assumes some level of access to the Windows 11 device, and Microsoft shipped mitigations as part of this year—2026—updates back in April. All in all, you should be interested in what happened and how the attack worked. For that, read the excerpt below. ...the team demonstrated they could reach into parts of the system Windows is built to keep off-limits, including memory the operating system itself is not supposed to touch. By creating these memory aliases, the researchers showed an attacker could: Turn hundreds of blocklisted drivers with known vulnerabilities back on Kill antivirus and endpoint detection and response (EDR) software, How QR-code phishing can slip past corporate security measures If you're comfortable using something every day, don't rule out that it can't be turned against you. That's why you should never let your guard down. This is an example of such a scenario. Scan QR codes out of necessity alone, if it's in an email, use another medium to check with the sender if they actually sent it, and never stop learning how cyber criminals are innovating ways to steal from you. From the article: Most importantly, they take the victim from a relatively well-protected corporate environment to a potentially unmanaged mobile device, thus bypassing business-grade security. One important advantage for the attacker is concealment. The destination is encoded in a visual pattern, not displayed as readable text, which hides th

Introduction Authentication is one of those things that looks simple in a tutorial and becomes surprisingly complex in production. Between token storage, CSRF protection, refresh flows, and protected routing, there are many places to get it wrong—and getting it wrong has real security consequences. In two earlier posts, I covered pieces of this puzzle: Enabling CSRF in a JWT-Based React + Spring Boot Application and Storing Personal Information in React: sessionStorage vs Context API . This post ties those threads together into a complete, end-to-end authentication flow you can adapt for enterprise applications. We'll walk through the full journey: login → token issuance → secure storage → protected routes → token refresh → logout. Architecture Overview Before the code, here's the high-level flow: ┌──────────────┐ ┌──────────────────┐ │ React │ │ Spring Boot │ │ Frontend │ │ Backend │ └──────┬───────┘ └────────┬─────────┘ │ 1. POST /login │ │─────────────────────────>│ │ │ validate credentials │ 2. JWT (httpOnly cookie)│ issue access + refresh │<─────────────────────────│ │ │ │ 3. GET /protected │ │ (+ CSRF token) │ │─────────────────────────>│ validate JWT + CSRF │ 4. Protected data │ │<─────────────────────────│ │ │ │ 5. POST /refresh │ │─────────────────────────>│ rotate tokens │ │ │ 6. POST /logout │ │─────────────────────────>│ invalidate session Key Design Decisions Decision Choice Rationale Token storage httpOnly cookies Not accessible to JavaScript → mitigates XSS token theft CSRF protection Double-submit / token pattern Required when using cookies Token type Short-lived access + refresh Limits exposure window State management Context API for auth status Centralized, lightweight Why httpOnly cookies over localStorage? As I discussed in the storage blog, localStorage is readable by any script on the page—making it vulnerable to XSS. httpOnly cookies trade that risk for the need to handle CSRF, which we address below. Step 1: Backend — Login and Token Issuance

Everyone has probably tried adding an MCP server and knows that it only takes a few lines of JSON....

I've been digging into multisig configurations for bridge and protocol security reviews. The threshold gets all the attention — 3-of-5, 4-of-7, whatever. But after checking a few dozen Safes on mainnet, the threshold is rarely the weakest link. There are five other things that determine whether a Gnosis Safe actually protects funds, and most people only check the first one. This post walks through all of them, with cast commands you can run yourself. What the threshold does The threshold sets the minimum number of owner signatures required to execute a transaction through execTransaction() . If threshold is 3 and you have 2 signatures, the call reverts. Simple. # check threshold and owners cast call <SAFE> "getThreshold()(uint256)" cast call <SAFE> "getOwners()(address[])" This is the part everyone understlse. What the threshold does NOT protect 1. Modules This is the biggest blind spot in multisig security. Safe modules are contracts authorFromModule()`. A module can execute*any transaction from the safe without a single owner signature*. The threshold is irrelevant. The module has its own authority. `bash if this returns anything other than an empty array, investigate cast call "getModulesPagin[],address)" \ 0x0000000000000000000000000000000000000001 10 ` Modules are legitimate — timelockation. But a malicious or compromisedmodule is a full bypass of every threshold. Your 7-of-10 means nothing if a module can move funds independently. 2. Guard A guard contract implements checerExecution() . It adds validation on top of the threshold — restricting destinations, limiting values, blocking certain operations. The guard address lives at a specific storage slot. If it's 0x00 , there's no guard. No additional checks beyond threshold + signatu `bash guard storage slot (keccak256("guard_manager.guard.address")) cast storage \ 0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8 0x000...000 = no guard installe ` A guard can enforce things like "no transfers ab

Short answer: model each SMS OTP as an auditable challenge that can be consumed once, and make the server—not the mobile screen—the authority for expiry, autofill acceptance, repeat-request limits, and recipient suppression. Those decisions belong in the security contract before a messaging adapter is selected. The concrete problem is deceptively small: a mobile user asks for a code, the app receives a text, and the user signs in. In production, the same endpoint is also a spending endpoint, a privacy boundary, and a fraud signal. A duplicate tap, a delayed carrier message, or a recycled phone number can turn a pleasant login flow into an account-enumeration or SMS-bombing incident. I approach this like a ledger. Every state transition needs an idempotency key, an audit record, and a clear owner. Seven invariants keep the design reviewable. Stop. Consent, retention, and privacy records The server creates a challenge with a random, short-lived code, stores only a salted hash, and binds the challenge to a normalized recipient plus a login intent. The client receives an opaque challenge identifier; it never decides whether a code is valid. Verification consumes the challenge atomically, so two concurrent requests cannot both win. A resend is a new delivery attempt on the same login intent, subject to a cooldown and a rolling budget. It must not silently invalidate a code that is already in transit unless the product explicitly documents that behavior. Suppression is checked before dispatch and again when delivery feedback is ingested. That second check matters for bounces, reassigned numbers, and manually blocked recipients. Option Strength Cost or boundary One service owns challenge and delivery state Simple audit trail and exactly-once verification Requires a durable store and transactional writes Separate identity and messaging services Teams can deploy independently Correlation IDs and replay rules cross a network boundary Client-generated code or expiry Fast proto

Most developers assume running a real web platform on AWS costs a fortune. Mine doesn't. HomeServerLab — a free AWS learning platform with an AI assistant, tutorials, OAuth login, and an Apps Marketplace — runs for less than $1/month in infrastructure costs. Here's exactly how. The stack and what it costs AWS Lambda Every route on the site is handled by a single Lambda function written in Python. No EC2, no always-on server, no idle costs. Lambda charges per invocation and per GB-second of compute — at my traffic levels, it stays well within the free tier and costs virtually nothing beyond it. API Gateway HTTP API The entry point for all requests. HTTP API is significantly cheaper than REST API on AWS — $1 per million requests. At my current traffic, this rounds to zero. DynamoDB Handles rate limiting, user sessions, chat history (with TTL), and OAuth state. On-demand pricing means I pay per read/write, not for provisioned capacity. Again, within free tier at my scale. Amazon Bedrock (Nova Micro) Powers the built-in AI assistant. Nova Micro is one of the cheapest foundation models available on Bedrock — and with a 25 messages/day rate limit per user, costs stay negligible. Cloudflare (Free plan) Sits in front of everything: DNS and proxying, CDN and caching (reduces Lambda invocations), WAF and bot protection, DDoS mitigation, and Cloudflare R2 for the Apps Marketplace (10GB free tier). All of this on the free plan — $0/month. CloudFront (Free tier) Sits between Cloudflare and Lambda as an additional layer. 1TB of data transfer and 10 million requests/month free. More than enough. The real cost The only real cost is Bedrock — and even that is minimal with rate limiting in place. Everything else stays within free tiers at my traffic levels. Total: less than $1/month. The key insight Serverless means you pay for what you use, not for what you reserve. Combined with Cloudflare's free plan absorbing most of the traffic before it even hits AWS, the actual billable usage

The private equity giant confirms a breach, weeks after Google researchers said hackers were targeting financial companies.

Senator Ron Wyden sent a letter to the U.S. federal watchdog requesting a comprehensive review of how the FBI, DEA, ICE's HSI, and the Secret Service use hacking tools and spyware against Americans.

A manual psql check answers exactly one question: does this policy work right now, against today's schema, with today's roles. It says nothing about tomorrow. Three ordinary changes are enough to quietly break tenant isolation without anyone noticing at review time. A migration that drops and recreates a table loses RLS entirely, since it's a per-table flag, not something that travels with column definitions. A new service role for a background job can skip the policy if nobody remembers to apply it. And the most common one: someone grants BYPASSRLS during an incident and never revokes it. Most guides point you at pgTAP here and stop. pgTAP is fine, but it's a separate SQL-based framework with its own runner. If your backend is already on Jest, you don't need a second test framework, you need a Jest test that actually proves a leak can't happen. The core pattern: seed a row as tenant A, query as tenant B, assert the result is empty. Run it through a dedicated low-privilege role, since table owners and superusers bypass RLS by default even with FORCE enabled for the owner. I break down the full pattern, the queryAsTenant helper, testing WITH CHECK on INSERT/UPDATE, catching accidental BYPASSRLS grants, and wiring it into GitHub Actions here: https://devencyclopedia.com/blog/postgres-rls-testing-jest If you're doing this across more than one or two tables, I also built RLSBuilder, a browser tool that generates the CREATE POLICY SQL and a matching Jest test from the same three inputs so they can't drift apart: https://devencyclopedia.com/tools/rls-builder

Iran Doesn't Need to Mine Hormuz — Your requirements.txt Is Already Rigged Every headline you've read this week is a diversion. The Strait of Hormuz is not the target. You are. And you have been for months, possibly years, while you retweeted tanker tracking maps and debated whether Brent crude would touch $150. Iranian state-sponsored groups — OilRig, APT33, MuddyWater, Agrius — did not spend the last decade pivoting to cloud infrastructure so they could watch you panic about a waterway. They did it so they could own your build pipeline while you were distracted. And they have. This is not speculation. CISA Advisory AA24-038A explicitly maps Iranian APT campaigns against U.S. and allied critical infrastructure to cloud identity, Kubernetes targets, and software supply chains. Not SCADA. Not PLCs. Your kubectl binary. Your Helm charts. That FastAPI microservice running payment webhooks that you deployed on a Friday and haven't touched since March. The Revolutionary Guard does not need a mine. They need a maintainer who hasn't updated python-jose in fourteen months. The Theater and the Operation You watched the Strait. They watched your CI/CD. Geopolitical analysis is a spectator sport for infrastructure engineers, and Iranian cyber command is the bookie. While your LinkedIn feed filled with satellite imagery and retired admirals explained chokepoint logistics, the actual operation ran silently against: Public Helm charts with hardcoded cluster-admin ServiceAccounts FastAPI services with python-multipart handling unbounded file uploads on single-threaded Uvicorn workers .kube/config files exfiltrated from developer laptops in a dev-legacy namespace that predates your current CTO Terraform state stored in a single S3 bucket with versioning disabled and a policy written by someone who left in 2021 The Hormuz closure narrative is Information Operations . The closure of your API gateway due to an unpatched ASGI memory exhaustion vulnerability is the kinetic effect. You a

Architecture is not a fixed choice made once; fitness is a moving target driven by changing regulations, tech, and markets. Even a sound design can silently stop fitting over time without bad calls. Spanning seven articles on context stores, gateways, and topologies, this collection treats architecture as an evolving sociotechnical craft where teams deliberately shape friction, fitness, and flow. By InfoQ

The AI Security Institute has a new report of AI systems engaging in “unsanctioned behavior”—what I have been calling “ genie behavior —while being tested on their cybersecurity capabilities. The incident stemmed from a single evaluation where agents were given a task of solving a cyber security challenge. We ran this challenge 122 times across several models. Our investigation found that in 10 of those runs, an AI agent took autonomous, unsanctioned action on the live internet, targeting real people and organisations. In total, we catalogued 19 such actions. Almost all of this behaviour (17 actions) came from a single model, Anthropic’s Mythos 5, with 2 actions involving OpenAI’s GPT-5.6-Sol with cyber classifiers (mechanisms to prevent misuse) disabled. In the most serious case, an agent tried to insert malicious code into an open-source project. In an attempt to get the code approved, the agent engaged in social engineering—creating fake online identities and using them to pressure the project’s maintainer to approve the code. A human maintainer caught and refused to approve the malicious code...

Um 02:47 Uhr stoppte mein System ein Deployment. Kein Mensch war wach. Es war ein Dienstagmorgen, als mein Guard-System anschlug. Nicht wegen eines fehlgeschlagenen Tests. Nicht wegen eines Syntaxfehlers. Ein Agent hatte versucht, einen Commit zu pushen, der einen AWS-API-Schlüssel enthielt. Der Schlüssel steckte in einer Konfigurationsdatei, die eigentlich nie ins Repository sollte. Der Deployment-Prozess wurde blockiert. Um 02:47 Uhr. Kein Mensch hätte das um diese Zeit gesehen. Der Schlüssel wäre live gegangen. Das war kein Einzelfall. Es war der 47. Vorfall in 14 Monaten, den mein System automatisch abgefangen hatte, bevor er Schaden anrichten konnte. Und er hat mir klarer als je zuvor gezeigt, warum das Regelwerk wichtiger ist als das Modell selbst. Was ein Guard-System wirklich ist Die meisten, die über KI-Sicherheit sprechen, meinen Alignment, Halluzinationen oder Trainingsdaten. Das sind echte Probleme, aber sie liegen auf einer anderen Ebene. Ich rede von etwas Handwerklichem: einem System, das verhindert, dass ein KI-Agent im laufenden Betrieb Fehler macht, die Menschen Geld oder Daten kosten. Mein System läuft auf einem Prinzip, das ich GRIP nenne: Guards, Rules, Isolation, Protocol. Jeder Agent, der in meinem Stack läuft, durchläuft vor jeder kritischen Aktion eine Prüfkette. Nicht als Empfehlung. Als harter Block. Das bedeutet konkret: Der Agent darf nicht weiter, bis das Problem behoben ist. Kein Fallback, kein "try anyway", kein Override ohne explizite Freigabe. # Beispiel: Pre-Commit Guard gegen Secrets #!/bin/bash STAGED_FILES = $( git diff --cached --name-only ) for FILE in $STAGED_FILES ; do if grep -rE "(AKIA[0-9A-Z]{16}|sk-[a-zA-Z0-9]{32,}|ghp_[a-zA-Z0-9]{36})" " $FILE " 2>/dev/null ; then echo "GUARD BLOCK: Potential secret detected in $FILE " echo "Deployment halted. Remove secret before proceeding." exit 1 fi done Das ist kein ausgeklügeltes KI-Modell. Das ist ein Shell-Skript, das seit Monaten zuverlässig seinen Job macht. 176 Regeln und wie

Security researchers at Wiz recently examined S3-compatible object storage services across six popular neoclouds, revealing significant security gaps compared to Amazon S3. While S3 has become the de facto standard for object storage, most services lack several of AWS's security protections. By Renato Losio

Top AI Agent Security & Guardrails Frameworks in 2026: Defending Against Prompt Injections & Tool Hijacking As AI agents transition from read-only chatbots to autonomous actors with tool execution privileges (SQL queries, API calls, shell execution, email dispatch), application security has become the number one blocker for production deployment. A simple prompt injection against a chatbot produces bad text; a prompt injection against an agent can drop production databases, exfiltrate API keys, or hijack customer sessions . In 2026, securing an AI agent requires a multi-layered defense architecture across inputs, model reasoning, tool invocations, and memory stores. The Top 5 AI Agent Security & Guardrail Frameworks in 2026 ┌─────────────────────────────────────────────────────────┐ │ Input Defense & Sanitization │ │ (Lakera Guard / Rebuff / Preamble) │ └────────────────────────────┬────────────────────────────┘ │ ┌────────────────────────────▼────────────────────────────┐ │ Execution & Policy Enforcement │ │ (NVIDIA NeMo Guardrails / LLM Guard) │ └────────────────────────────┬────────────────────────────┘ │ ┌────────────────────────────▼────────────────────────────┐ │ Tool Scoping & Sandboxed Runtime │ │ (Docker / E2B / Fly Machines Sandboxes) │ └─────────────────────────────────────────────────────────┘ 1. NVIDIA NeMo Guardrails: Programmable Semantic Rails NeMo Guardrails uses Colang to define programmable dialogue flow, topical boundaries, and safety constraints. Core Capabilities: Topical Rails : Ensures the agent stays strictly on domain (e.g., banking support cannot discuss medical advice). Execution Rails : Intercepts tool calls before execution to verify parameter safety. Hallucination Rails : Validates that outputs are strictly grounded in retrieved RAG context. 2. LLM Guard (Protect AI): Open-Source Scanner Suite LLM Guard is a modular security toolkit providing 30+ dedicated scanners for input and output validation. Key Scanners: Prompt Injection Detecto

1. Basic Information Article Title : ArrayRef Rust Crate Supply Chain Attack Publisher : StepSecurity Publication Date : 2026-08-20 Severity : Critical Original Source : StepSecurity Related Source : Hackers poison ArrayRef Rust crate to push infostealer malware Related Malware : proc-macro1 dropper, proc-macro-en dropper Threat Actor : None / Unidentified CVE : None Products & Technologies : arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9, Cargo, crates.io 2. Executive Summary A supply chain attack that adds malicious dependencies to legitimate crates from compromised developer accounts, launching information-stealing malware during the build process without needing to execute the target code. Reason for Severity: Widely used legitimate crates and related crates were tampered with in quick succession. Execution happens simply by Cargo resolving dependencies and building. Developer machines and CI/CD credentials are the targets. 3. Attack Flow Infection During Cargo Build The attacker compromises crate administrator accounts and publishes malicious versions of arrayref, internment, and append-only-vec. While keeping the legitimate code, they add dependencies on typosquatted proc-macro1/proc-macro-en and include a build.rs script. When a developer or CI resolves new dependencies, updates them, and builds, build.rs runs automatically. There is no need to call functions in the target crate. build.rs disables TLS certificate verification to download the next stage and runs it from a temporary folder. On Linux, it establishes persistence in user settings and systemd. On Windows, it runs temporary PowerShell/VBS scripts. The next stage collects credentials from browsers and development environments, then sends them to the attacker. Luring Users to Malicious Versions For arrayref, the clean version was yanked, and dependency resolution was manipulated to pull the malicious version. Due to deleted versions, local caches, and vendoring states, it is hard to judge sa

Nobody opens a ticket for an SPF record. There is no alert, no dashboard turning red, no user calling to say that an IP address from a provider the company stopped paying two years ago is still authorized to send email on its behalf. That is exactly what makes it dangerous. I audited the SPF record of a mid-sized manufacturing company in Brazil and found authorized senders that had not been part of the environment for years. Nothing was broken. Email was flowing normally. And that is the point — a bloated SPF record does not fail loudly. It fails quietly, on the day someone decides to use it. The problem The company had migrated its email to Microsoft 365. The migration itself went fine — mailboxes moved, mail flow worked, users were happy, project closed. What nobody revisited was DNS. The SPF record still authorized the IP ranges of the previous email security provider, alongside the current include:spf.protection.outlook.com. Those ranges had been left in place when the provider was decommissioned, and nothing in the environment depended on them anymore. The record said, in effect: these servers are allowed to send email as us. And they were no longer under our control. Two concrete risks come out of that: Spoofing surface. An SPF record is an authorization list. If infrastructure you no longer control is still on it, and that infrastructure is ever repurposed, resold, or compromised, mail from it passes SPF authentication as your domain. Receiving servers will trust it, because you told them to. The 10-lookup limit. SPF allows a maximum of 10 DNS lookups when evaluating a record. Mechanisms like include, a, mx, ptr and redirect each consume from that budget, and nested includes count too. Cross the limit and the evaluation returns permerror — which many receivers treat as a failed check. Legacy entries do not just sit there harmlessly; they consume a budget you may need the next time a business team adopts a new platform. The constraints This is the part that sh