Engineering
Hacking SAML with Claude Code
After many years of complaining about how insecure SAML is, I decided to try to prove it by using Claude Code to hack every SAML implementation I could find.
CTO
CTO
Blog
Insights
What's still annoying about SOC 2 in 2026
We completed our first SOC 2 audit. We still suffered through manual access reviews, scattered evidence, and proving compliance with bygone requirements.
CEO
CEO
Insights
What a great users page looks like
Your users are probably looking at your application’s user list because they're completing an audit or dealing with an incident. Here’s what they need to know.
CEO
CEO
Insights
What is separation of duties, anyways?
Separation of duties is framed as about blocking toxic role combinations, but what you really want is to stop someone from approving their own transactions.
CEO
CEO
Insights
The security policy rollout survival guide
The hardest part of a security policy isn't writing it, it's rolling it out. The controls have to work, and your users can't hate you when it's all done.
CEO
CEO
Engineering
Generating an MCP server in Go
MCP is table stakes for any service, and Go's official SDK makes support trivial. The hard part is staying current, so we generate ours from Protobuf.
CTO
CTO
Engineering
The performance bug hiding in our billing settings
How we spent two months debugging Cloud Run latency, built out our tracing along the way, and learned the fix was one line of YAML.
Software Engineer
Software Engineer
Engineering
How Oblique handles code review etiquette
Code reviews aren’t just about ensuring engineering quality, they’re also about building team culture. Focus on communication and understanding rather than nit-picking style quirks.
Software Engineer
Software Engineer
Engineering
The $0 security stack
As part of our initial SOC2 audit, we wanted to put in place actually useful security tools. Luckily, in 2026, world-class security costs literally nothing.
CEO
CEO
Engineering
Passkey PRFs for end-to-end encryption
The passkey PRF extension lets syncable credentials do much more than login users. See how apps are using this for end-to-end encryption.
CTO
CTO
Insights
Fit access controls to your org, not the other way around
Groups used for access controls can be based on department, reporting chain, or projects. The right answer is whatever maps best to how your org actually works.
CEO
CEO
Insights
Access requests are a bandaid, not a fix
IT teams are overwhelmed with never-ending access requests. Getting off the identity treadmill means getting to fewer tickets over time, not faster tickets.
CEO
CEO
Engineering
Go’s synctest is amazing
We threw Go’s new “testing/synctest” package at a particularly gnarly part of our codebase and were pleasantly surprised by how effective it was.
CTO
CTO
Engineering
Type safe frontend APIs
Introduction to using Protobuf and Connect for type-safe frontend API calls from the frontend to the backend.
Software Engineer
Software Engineer
Insights
The real SSO tax
The SSO tax shouldn't be about having SSO — it should be about enforcing it. The value of SSO is to centrally manage access and require strong authentication.
CEO
CEO
Insights
What we can learn from real-world authentication failures
Recent breaches at Okta, Snowflake, and Twitter help us learn how to prevent authentication failures like credential theft, MFA bypass, and session hijacking.
CEO
CEO
Insights
Internal security tools rarely get the UX they deserve
Security teams underestimate the investment needed for internal tools, and so underinvest in UX. When security tools are painful to use, people bypass security.
CEO
CEO
Insights
Modern access controls: takeaways on what actually works
We interviewed IT and security teams to ask them how they actually define, implement, and improve their access control policies. Get the report to learn more.
CEO
CEO
Insights
Delegate authority to those with context
Business teams have context for access decisions but lack authority. Delegate to those closest to the resources by defining clear ownership for each app.
CEO
CEO
Insights
Stop trying to make git happen
Internal tools built as code come with version control and audit logs for free, but git becomes a barrier for non-engineers to use these tools.
CEO
CEO
Insights
Why your RBAC roles aren't actually roles
A role in RBAC should represent what someone actually does in your environment. Your job title makes a bad RBAC role: it's your position, not your function.
CEO
CEO
Insights
Comms groups inevitably become access groups
Comms groups map to how people actually work, but often access groups don't. Comms groups always become access groups. It's not a matter of if, but when.
CEO
CEO
Engineering
Injection-proof SQL builders in Go
SQL builders are always one bad logic bug away from full-blown query injection. Oblique uses Go type tricks to prevent this entire class of backend issues.
CTO
CTO
Insights
The evolution of authentication, from passwords to passkeys
Authentication has evolved from simple passwords to federated systems with passwordless logins, continuously balancing security and usability.
CEO
CEO
Engineering
Authenticating GitHub Actions without API keys
Instead of minting long-lived API keys and warning users “keep this secret,” let's use GitHub Action's OpenID Connect support instead.
CTO
CTO
Insights
Good justifications write themselves
Organizations ask users to fill out justification fields when requesting access, but these are useless explanations. You should already have the context.
CEO
CEO
Insights
Chesterton's fence doesn't apply to access controls
IT teams are scared to remove access they don't understand, leading to sprawling entitlements. Removing unused access isn't risky — never removing access is.
CEO
CEO
Company
Identity management is harder than it should be
Identity management is surprisingly hard: access controls change constantly and require context. We founded Oblique to work on impactful security problems.
CEO
CEO