I’m a product marketing and developer relations leader with more than a decade of experience turning technical products into movements and fans into evangelists
Joined September 2025
- Tweets67
- Following19
- Followers2
- Likes4
The key to effective product marketing is honesty. Really, that's it.
Also figuring out SEO, AEO, GEO, comparative analytics, competitor positioning, narrative strength, and a billion other variables.
But mostly honesty.
#productmarketing #marketing
An LLM audits a production flows.json and finds 16 crimes. Claude cleans up messy MQTT. Real-time OEE runs on a tea bag line.
Node-RED Con 2026: 12 talks from people running Node-RED in production. Free and online, Nov 3.
nrcon.nodered.org/
#nodered #industrialautomation
Industrial AI can't just be generalised AI - it needs to be built for industry. I legitimately think FlowFuse has one of the best solutions in this space (flowfuse.com/ai/) - and it's leagues better than just asking ChatGPT to build a ModBus bridge. #IndustrialAutomation
I've written 750+ articles and whitepapers and 12 books on API and application security. The same 7 mistakes keep popping up again and again.
Let's talk about them. 🧵
Mistake #7: Stop assuming every caller is human. More and more traffic is coming from agents. If your API can't tell user from agent, your audit trail and rate limits are worthless. Start paying attention - and dealing with it properly.
Mistake #6: If you don't know what APIs you are actually running, you're asking for trouble. Keep an inventory and actually pay attention. It can be a spreadsheet, but that's pretty silly - make an API directory and keep it constantly updated.
Mistake #5: Stop sending the whole object and just letting the frontend filter it. That whole object contains a ridiculous amount of info that can be used for horizontal escalation. Return only what the client needs - and do the work to figure that out first.
Mistake #4: Letting your tokens run everything. Tokens that can do anything are awful and you're basically asking to be attacked. One token with full scope is easy for you - but it's easy for an attacker too. Least privilege should be table stakes at this point.
Mistake #3: Using API keys as identity. That's never what it was meant to do - and when keys get copied into repos, Slack, Claude, screenshots, whatever, you break the system. Deploy actual identity management, PLEASE.
Mistake #2: Treating the API gateway as a security model. A gateway is just a front door, and it doesn't know your business logic, data relationships, or who owns which record. If authorisation only lives at the edge, you don't actually have authorisation.
Mistake #1: Checking who you are, but not what you're allowed to touch. I see this over and over again. If I can change from orders/1001 to orders/1002 and see someone's order, that's BOLA, which has topped OWASP top ten for years now.
製造業のあり方が大きく変わりつつあります。日本はGX（グリーントランスフォーメーション）を国家戦略に掲げ、経済産業省は「グリーンイノベーション基金」を通じて脱炭素技術への投資を加速させています。
lnkd.in/p/gzJ6ZMJS
#GX #脱炭素 #製造業 #ものづくり #再生可能エネルギー
MCP is not GraphQL no matter how many naysayers want it to be. GraphQL was built for a Facebook problem and adopted everywhere because Facebook did it - but MCP and associated protocols/frameworks are agnostic and carry actual value. This should not be a hot take. #ai
Me in 2016: Man, AI is interesting. I should probably learn some better maths to understand what’s going on.
Me in 2026: Writing a paper on the epistemological reality of AI and the delta between performant knowledge in humans vs. RAG systems.
The AI trap is real!
Listen, I say this as an AI advocate. Local consumer LLMs are kind of terrible right now. But they're going to kill cloud AI anyway - and that train's barrelling down the tracks faster than you think.
open.substack.com/pub/kristo…
#artificialintelligence #softwaredevelopment
Here's a hot take for you: the industrial space needs to be braver. The frontier technologies are here. The new protocols are here. The new providers are here. The end users have been waiting. It’s time we stopped making them wait.
open.substack.com/pub/kristo…
#industrialautomation
Vibe coding is in the news these days, and for largely negative reasons. And in many cases, fair enough. But the problem was never the vibe coding - it's the approvals process that allows it to proliferate unchecked.
So let’s talk about that.
kristopherleads.substack.com…
#AI
Kristopher Sandoval retweeted
Hello everyone! 👋
The 191st issue on #SoftwareTesting is out.
👉 softwaretestingnotes.substac…
Great articles and resources by @jemimaabu, @HirudiniU, @RyanCraven_QA, @s_radzyminski, @lord_beh, @Maaikees, @KristopherLeads and more ! 👏
#QA #testing
ALT Issue #191 : Software Testing Notes
Math in my Reinforcement Learning? DEJA VU #reinforcementlearning #learnai #dejavu #maths
youtu.be/lfVqdRV20lY
#reinforcement #learnai #rl #reinforcementlearning #machinelearning #artificialintelligence #softwaredevelopment #tutorial #crashcourse