sandeepsidhu.com · in production since 2010
Security and observability for teams without a security team.
I'm an SRE who has run production infrastructure for 20+ years. I write about securing your systems, monitoring them properly, and putting AI agents to work in your engineering workflows. Everything here comes from work I've actually done.
Recent entries
Full log 2010-2026- 2026-08-02 Remote desktop lessons: hidden cursors, black frames, and testing Windows without a screen
I shipped four small remote-desktop features this week: view-only by default, a draggable session banner, showing the end user's mouse, and real multi-monitor support. The features were the easy part. These are the notes I want to remember from making them work.
- 2026-08-01 Two years of building a security platform solo with AI agents: the honest architecture tour
One SRE, two regions, one security platform in production. What the architecture looks like, what the AI agents did, where they burned me, and what I would not do again.
- 2026-07-31 Change windows for machines: the CI build that unlocked, deployed, and relocked prod by itself
We gave the deploy pipeline the same deal a human operator gets: file a change, get a window, do the work, get locked out again. This week a build rode the whole loop with zero human touches.
- 2026-07-31 SOC 2 for a 10-person SaaS: what I'd actually do first
A customer asked for your SOC 2 report and you have no security team. Here is the order I would do things in, from someone who builds compliance tooling and runs production for a living.
- 2026-07-29 An AI-built agent wedged a 2GB prod host: unbounded maps, OOM loops, and the fixes
A monitoring agent is supposed to be the lightest thing on the box. Ours ate a small host alive - and the command path that could have fixed it remotely was broken in the same binary. A post-mortem.
- 2026-07-27 Capturing security events with eBPF: from fork-storm noise to a usable signal
eBPF gives you every exec on a host, far more than anyone can read. How our agent DDoSed itself with docker inspect, why container healthchecks are the loudest thing on a server, and the filtering that turned a firehose into a signal.