Dev - title - M1 security hardening + blog content: Post A, Post B, article updates

components/blog/articles/encryption-bug-aes-gcm-ephemeral-key.tsx

@@ -314,7 +314,7 @@ it("produces different ciphertexts for the same plaintext", async () => {
         on GitHub. The security case study behind this fix — covering the threat model, attack trees, and the
         key-custody tradeoff spectrum — is{" "}
         <a
-          href="https://topflow.dev/blog/02-secrets-at-rest-byok-encryption"
+          href="https://github.com/csupenn/topflow/blob/main/docs/AI-Security/osv-scanner/02-secrets-at-rest-byok-key-encryption-2026-06-14-draft.md"
           target="_blank"
           rel="noopener noreferrer"
           className="text-primary hover:underline"

components/blog/articles/five-layers-of-security-owasp-top-10.tsx

@@ -250,12 +250,13 @@ const WorkflowSchema = z.object({
       <div className="bg-card border border-border rounded-lg p-6 my-6 space-y-3">
         <h3 className="text-lg font-semibold text-foreground">Go Deeper</h3>
         <p className="text-sm">
-          The AI Security Tutorial series covers each of these controls in detail — threat models,
-          attack trees, design trade-offs, and hands-on labs.
+          The AI Security Tutorial series covers each of these controls in full — threat models,
+          attack trees, design trade-offs, and hands-on labs. Tutorials live in the GitHub repo
+          alongside the code they document.
         </p>
         <div className="flex flex-wrap gap-x-6 gap-y-2 text-sm">
           <a
-            href="https://topflow.dev/blog/01-ssrf-cycle-detection-rate-limiting"
+            href="https://github.com/csupenn/topflow/blob/main/docs/AI-Security/osv-scanner/01-ssrf-cycle-detection-rate-limiting-2026-06-14-draft.md"
             className="text-primary hover:underline inline-flex items-center gap-1"
             target="_blank"
             rel="noopener noreferrer"
@@ -264,7 +265,7 @@ const WorkflowSchema = z.object({
             <ExternalLink className="w-3 h-3" />
           </a>
           <a
-            href="https://topflow.dev/blog/02-secrets-at-rest-byok-encryption"
+            href="https://github.com/csupenn/topflow/blob/main/docs/AI-Security/osv-scanner/02-secrets-at-rest-byok-key-encryption-2026-06-14-draft.md"
             className="text-primary hover:underline inline-flex items-center gap-1"
             target="_blank"
             rel="noopener noreferrer"
@@ -273,7 +274,7 @@ const WorkflowSchema = z.object({
             <ExternalLink className="w-3 h-3" />
           </a>
           <a
-            href="https://topflow.dev/blog/04-durable-rate-limiting-upstash-redis"
+            href="https://github.com/csupenn/topflow/blob/main/docs/AI-Security/osv-scanner/04-durable-rate-limiting-2026-06-14-draft.md"
             className="text-primary hover:underline inline-flex items-center gap-1"
             target="_blank"
             rel="noopener noreferrer"

components/blog/articles/preventing-ssrf-attacks-ai-workflows.tsx

@@ -174,7 +174,7 @@ export function assertSafeOutboundUrl(rawUrl: string): void {
         </p>
         <div className="flex flex-wrap gap-4 text-sm">
           <a
-            href="https://topflow.dev/blog/01-ssrf-cycle-detection-rate-limiting"
+            href="https://github.com/csupenn/topflow/blob/main/docs/AI-Security/osv-scanner/01-ssrf-cycle-detection-rate-limiting-2026-06-14-draft.md"
             className="text-primary hover:underline inline-flex items-center gap-1"
             target="_blank"
             rel="noopener noreferrer"

components/blog/blog-content.tsx

@@ -10,6 +10,7 @@ import { SSRFPreventionContent } from "@/components/blog/articles/preventing-ssr
 import { BudgetSaaSContent } from "@/components/blog/articles/20-dollar-saas-infrastructure"
 import { GDPRAutomationContent } from "@/components/blog/articles/gdpr-automation-3-minutes"
 import { EncryptionBugContent } from "@/components/blog/articles/encryption-bug-aes-gcm-ephemeral-key"
+import { URWContent } from "@/components/blog/articles/untrusted-reasoning-worker-llm-security"
 
 interface BlogContentProps {
   slug: string
@@ -25,7 +26,8 @@ export function BlogContent({ slug }: BlogContentProps) {
     "preventing-ssrf-attacks-ai-workflows": <SSRFPreventionContent />,
     "20-dollar-saas-infrastructure": <BudgetSaaSContent />,
     "gdpr-automation-3-minutes": <GDPRAutomationContent />,
-    "encryption-bug-aes-gcm-ephemeral-key": <EncryptionBugContent />
+    "encryption-bug-aes-gcm-ephemeral-key": <EncryptionBugContent />,
+    "untrusted-reasoning-worker-llm-security": <URWContent />
   }
 
   const content = contentMap[slug]

lib/blog/blog-data.ts

@@ -181,7 +181,7 @@ export const blogPosts: BlogPost[] = [
     title: "The Bug That Made My Encryption Instantly Useless",
     excerpt:
       "I added AES-256-GCM encryption to protect BYOK API keys in localStorage. It compiled, tests passed—but every ciphertext was immediately unrecoverable. Here's the silent bug, the fix, and what it teaches about cryptographic code.",
-    publishedAt: "June 15, 2026",
+    publishedAt: "March 15, 2026",
     readTime: "9 min read",
     category: "Security",
     author: authorCharlie,
@@ -199,6 +199,29 @@ export const blogPosts: BlogPost[] = [
       ],
     },
   },
+  {
+    slug: "untrusted-reasoning-worker-llm-security",
+    title: "The Untrusted Reasoning Worker: Why I Don't Let the LLM Decide",
+    excerpt:
+      "Letting an LLM write a security report sounds convenient—until it starts inventing CVE IDs, accepts attacker instructions embedded in advisory text, and produces output no code can reliably check. Here's the pattern that fixes all three.",
+    publishedAt: "April 10, 2026",
+    readTime: "11 min read",
+    category: "Security",
+    author: authorCharlie,
+    seo: {
+      description:
+        "The Untrusted Reasoning Worker (URW) pattern: how to use an LLM on security-sensitive paths without letting it fabricate facts, accept prompt injection, or produce uncheckable output. Real code from TopFlow's GitHub Security Scanner.",
+      keywords: [
+        "LLM security",
+        "prompt injection prevention",
+        "AI agent security",
+        "constrained elicitation",
+        "LLM hallucination",
+        "agentic AI security",
+        "OWASP LLM top 10",
+      ],
+    },
+  },
   {
     slug: "gdpr-automation-3-minutes",
     title: "GDPR Automation in 3 Minutes: How TopFlow Handles Data Subject Access Requests",