CodeQL’s System Prompt Injection Query Is a Useful Start
CodeQL 2.26 can trace untrusted values into JavaScript and TypeScript system prompts, turning one AI security risk into something code review can see.
Engineering notes from the sharp end
Practical writing about software, systems, delivery, and things that behave strangely under pressure.
wade womersley – york based software engineer I write the way I work: direct, useful, and more interested in what holds up in production than what sounds clever on a slide.
Latest post
Archive
Recent writing
Software Engineer
GitHub Models closes on July 30, with brownouts first, so this is a migration deadline rather than a product update to read later.
PHP, Programming
PHP 8.6 Alpha 1 is not for production, but it is exactly when framework, library, and platform teams should begin compatibility testing.
AI
GPT-5.6’s Sol, Terra, and Luna tiers make model choice a practical cost decision instead of a hunt for one universal default.
Software, Software Engineer
Android developer verification should be treated like release infrastructure, especially for teams distributing outside Google Play.
Programming, Software
Jetpack Compose 1.11’s testing changes are worth planning for because timing assumptions can quietly break mobile test suites.
AI, Programming
Android Studio agent skills matter because coding agents need durable project knowledge, not repeated prompt folklore.
Random Stuff
A good meme does not need to be clever. It just needs enough people to commit to the bit.
AI, Programming
Android Studio’s Gemma 4 support matters because local coding agents change the trust model for mobile teams.
Programming, Software Engineer
C# 14’s field keyword reduces boilerplate in validation-heavy properties without turning ordinary property code into magic.