Pick a brief below. Each one opens with its answer, ends with how it was made and what it rests on, and can be saved as a PDF from the button at its top or from your browser's print menu.
Every brief opens with its answer and ends with its sources
Paving vulnerability classes
How to mine a history of true-positive vulnerabilities for the classes you can engineer out of existence with secure-by-default frameworks, libraries, APIs and platform controls, and what the evidence says about doing it without wrecking developer experience.
Research guide · Application security engineering · Version 0.9 · 29 Oct 2026 · 36 min read
End-of-life and unmaintained dependencies are one debt with three costs
An abandoned library is a security risk, a growing technical debt and a recurring drain on developer attention at the same time. The published accounts favour one response for all three, which is to make upgrading continuous, owned and cheap, rather than a periodic emergency.
Research brief · Software supply chain and engineering practice · Version 1.1 · 29 Oct 2026 · 26 min read
Cheap code moves the bottleneck to judgment
As AI agents make writing code cheap, the scarce work moves to deciding what to build, verifying what agents produce, and pushing decision rights to small teams. This brief collects what companies, researchers and labour-market data show about team shape, roles and pilots as of late 2026.
Research brief · Engineering organizations and AI · Version 1.1 · 29 Oct 2026 · 26 min read
Julie Davila · Research. Researched with AI agents and reviewed by Julie Davila: how this research is made. Text licensed CC BY 4.0. Source on GitHub.