Prince Baruwala
I write and edit Root Notes, from India. The site covers security — breaches, exploited vulnerabilities, the tooling attackers use — alongside AI, infrastructure and the companies building both.
How I work
Every piece starts at the primary source: the vendor advisory, the research write-up, the regulator's document, the filing. Where reporting is the only source, it is named as such. Quotations are kept short and few, and the rest is paraphrased with attribution, so a reader can tell what a company said from what I concluded.
Each article ends with what is not established — the attribution nobody has confirmed, the number two sources disagree about, the question the research leaves open. That section exists because a story that only lists what is known reads as more certain than it is. The full method is in the editorial policy.
Corrections and contact
If something here is wrong, tell me and I will fix it: hello@rootnotes.in. How corrections are handled is set out in the editorial policy.
Recent articles
- Kibana let one tenant claim another's data stream, and removing the package does not give it back — 2026-10-08
- The host key check ran, and passed, on a curve the attacker chose for it — 2026-10-08
- Two hours passed between the proof of concept going public and the first attempt landing in a honeypot — 2026-10-08
- Three years, 37,000 downloads for one package, and three of them are still installable — 2026-10-07
- Anthropic is giving verified defenders a model that refuses less, and the open question is who checks the badge — 2026-10-07
- Wikipedia's data is already free, so the agents went after the one thing that was not: a tool that would fetch URLs for them — 2026-10-07
- Handlebars checked the parts of the template it expected to see, and compiled everything else into JavaScript — 2026-10-07
- Atlassian says an attacker has to know the exact filename, which for an off-the-shelf product everybody does — 2026-10-07
- Chrome shipped 247 security fixes in one release, and the credits show where that number is coming from — 2026-10-07
- He sent 349,700 dollars to a laundering service to find out how it worked, and the five percent fee is the finding — 2026-10-07
The rest are in the archive.