Argemma Blog

Security-focused blog at argemma.com/blog. Posts skew practical and technical: credential and key management, concrete Go-language vulnerabilities (path traversal, timing attacks, recent CVEs), and threat models for new patterns like RAG. Audience is working security engineers, not generalist readers.

Kelby Ludwig (security engineer) is the author of the long-lived-keys post; the site doesn't make authorship attribution prominent on every post.

Recent posts (as of 2026-04-25)

• "You don't want long-lived keys" — April 2026 — ingested as long-lived-keys
• "Notes on Go's CVE-2026-27137 and CVE-2026-27138" — March 2026
• "The Lethal Trifecta, But You Don't Get a Choice" — March 2026
• "Go's filepath.Clean does not prevent path traversal" — January 2026
• "A threat model for RAG features" — January 2026
• "On string comparison timing attacks in Go" — January 2026

Ingested articles

• long-lived-keys — case for ephemeral credentials over rotation, with EC2 Instance Connect, PyPI Trusted Publishers, and SSO as patterns