Rotate Start here to off-page-1 posts; add Guide to nav; close 3 link loops

content/prompt-injection-supply-chain-evasion.md

@@ -1,5 +1,6 @@
 Title: Prompt Injection Will Become a Supply Chain Evasion Technique
 Date: 2026-06-12
+Modified: 2026-10-16
 Category: Threat Intelligence
 Tags: ai, supply-chain, prompt-injection, evasion, defensive-architecture
 Slug: prompt-injection-supply-chain-evasion
@@ -97,6 +98,6 @@ Treat LLM scanner output as evidence, the same way you would treat any other ana
 
 ## A new trust boundary
 
-Every time defenders add a new interpreter to a security workflow, they create a new trust boundary. Large language models are now part of that path.
+Every time defenders add a new interpreter to a security workflow, they create a new trust boundary. Large language models are now part of that path. Provenance signals are next: once enterprises automate decisions on a watermark detector, that detector becomes the same kind of boundary, which I examine in [When the Output Carries the Signal]({filename}claude-synthid-text-watermark-attack-surface.md).
 
 The reason this matters to me: I write security tooling for a living, and the tools I trust most are the ones that fail loud and route around themselves when they get confused. That is the property prompt injection takes away from your scanner. Get it back.

content/testing-an-iam-analyzer-against-its-own-claims.md

@@ -1,5 +1,6 @@
 Title: Testing an IAM Analyzer Against Its Own Claims
 Date: 2026-08-24
+Modified: 2026-10-16
 Author: Oliver Rivas
 Category: DevSecOps
 Tags: aws, iam, security-tooling, testing, devsecops
@@ -76,4 +77,4 @@ Unknown, unavailable, malformed, timed-out, and failed are explicit states. An e
 
 That one rule runs through the whole tool. It returns a machine-readable "unsupported" code on policy families it does not fully model instead of guessing as though the input were an identity policy, because unsupported is not the same as safe. It refuses to expand a `Deny` with `NotPrincipal` into an ordinary "deny everyone except X" exclusion: NotPrincipal in a Deny is matched by exact ARN, so a naive reading can deny far more or far fewer principals than intended, and principals with permissions boundaries add a further wrinkle. It treats an SCP or RCP as a ceiling, never a grant. And the review workflow refuses to accept a change a critic never actually reviewed.
 
-A security tool earns trust through how it behaves when it cannot be sure. The green build is table stakes. What the tool does when the honest answer is "I do not know" is the part worth reading.
+A security tool earns trust through how it behaves when it cannot be sure. The green build is table stakes. What the tool does when the honest answer is "I do not know" is the part worth reading. That rule is also the design brief for the CI gate built on this analyzer: [a pipeline check that blocks on "I do not know"]({filename}iam-blast-radius-github-action.md) instead of waving it through.

content/venezuela-twitter-proxy-osint-final.md

@@ -1,6 +1,6 @@
 Title: Catching a Nation-State Proxy: OSINT on Twitter
 Date: 2025-04-17
-Modified: 2026-06-04
+Modified: 2026-10-16
 Tags: osint, threat-intelligence, phishing, devsecops, venezuela
 Category: Threat Intelligence
 Slug: venezuela-twitter-proxy-osint
@@ -87,7 +87,7 @@ At the time of discovery, this site **did not contain malicious code**, but the
 
 The proxy remained active until at least December 2012, shortly before elections. To this day, the archived proxy content and WHOIS records serve as a warning about the ease with which social media can be co-opted in hostile environments.
 
-This investigation was one of the earliest times I realized how fragile trusted infrastructure becomes in the hands of a motivated actor, and how critical open-source techniques are in defending it.
+This investigation was one of the earliest times I realized how fragile trusted infrastructure becomes in the hands of a motivated actor, and how critical open-source techniques are in defending it. Fourteen years on, the same state has industrialized that playbook; I trace how a proxy on a login page grew into a national surveillance pipeline in [When Telemetry Turns Predatory]({filename}telemetry-turns-predatory.md).
 
 **Have you ever spotted unusual network redirections or infrastructure anomalies? What tools or tactics helped you confirm your suspicions?**
 

pelicanconf.py

@@ -190,6 +190,7 @@ def _asset_version() -> str:
 TAG_CLOUD_MAX_ITEMS = 10
 MENUITEMS = [
     ('About', 'https://rivassec.com/pages/about.html'),
+    ('Guide', 'https://rivassec.com/devsecops-guide.html'),
     ('Categories', 'https://rivassec.com/categories.html'),
     ('Search', 'https://rivassec.com/search/'),
     ('Tools', 'https://rivassec.com/tools/iam-blast-radius/'),
@@ -282,9 +283,12 @@ def _asset_version() -> str:
 
 # Homepage featured posts: hand-picked slugs, ordered. Surfaced at the
 # top of index.html as a "Start here" panel ahead of the chronological
-# feed.
+# feed. Rule: only feature posts that have aged off page 1 of the feed
+# (the newest DEFAULT_PAGINATION posts) — the template does not dedupe,
+# so a featured recent post would appear twice. Revisit every few posts
+# as strong pieces fall off page 1.
 FEATURED_POST_SLUGS = [
-    'paved-road-adoption-as-control',
     'iam-safe-defaults-fail-loud',
-    'teensy-efi-bruteforce-hours-late',
+    'paved-road-adoption-as-control',
+    'trust-decay-adversarial-hiring',
 ]