As AI use and sophistication grow, BOLA attacks have risen rapidly. Broken Object Level Authorisation (BOLA) is when an authenticated user can switch parameters like the URL in an API request and access other users' data. For example, GET https://api.example.com?client=32 returns the authenticated user's information, such as your age or other PII.
The authenticated user changes the client to "33"; I now get someone else's records, as the API only checks that I am an authenticated user, not that I am authorised to check another client.
| Action | URL | Result |
|---|---|---|
| GET | https://api.example.com?client=32 | The user sends valid authentication for their own client. The result returns their data. Correct. |
| GET | https://api.example.com?client=33 | The user sends valid authentication for their own client data but requests another client's info. The result returns the other client's private data. Incorrect behaviour. Major security issue. |
I recently started using StackHawk, and I am impressed with the tooling. Its DAST and API security testing are outstanding, and it integrates beautifully with VS Code.
Application security requires more than simple source code scanning. While SAST, SCA, and secrets scanning are great in CI pipelines, key vulnerabilities remain hidden until an application is running. This is where Dynamic Application Security Testing (DAST) becomes essential.
In my development environment, Claude and GitHub Copilot are building my code and do so much of the Static Application Security Testing (SAST) 7I don't feel compelled to use them in the IDE. Claude does a great job; it can do SAST and implement security best practices extremely well.
Software Composition Analysis (SCA) focuses on the third-party and open-source components our code relies on. Claude once again does a great job of identifying vulnerabilities and upgrading to the latest versions.
Security secrets: Claude once again does a great job, especially with remote repo integrations such as GitHub, ADO, and GitLab.
For enterprises building Azure-hosted web applications and APIs, StackHawk offers a developer-focused DAST approach that integrates directly into modern DevSecOps workflows. Unlike traditional DAST tools, which security teams often operate, StackHawk is designed to work with developers, providing rapid feedback during testing and deployment. This "shift left" saves time and money. There are various DAST options, but StackHawk has become my favourite. With the rise of AI coding, developer-level DAST is more important than ever.
BURP has been the standard for pen testing for many years. Three DAST tools focus on different things: Burp Scanner, OWASP ZAP, and StackHawk.Overview: Many approaches exist for building and deploying native apps to the App Store (Apple) and Play Store (Android). This post shows an approach that works well for converting a React web app into a Play Store app using the Expo toolchain. The choice remaining is whether to use a wrapper or port the code to native UI.
 |
| EXPO, as a company, has two independent products that work together nicely for mobile apps. |
 |
| Using Expo products to build and deploy native Apps onto the two main public stores using a wrapper or native approach) |
Managing cloud environments often involves jumping between alerts, logs, dashboards, and code repositories when something breaks. Azure SRE Agent aims to simplify operational troubleshooting. The tool:
The SRE Agent combines 1) Brain - Large Language Models (LLMs, either OpenAI or Anthropic models) with 2) Azure-specific product knowledge - tools and knowledge, and 3) Instructions - custom configuration. Allowing it to reason over operation support data.
The agent is deployed directly inside an Azure Resource Group, which sits within an Azure Subscription. I have only used the Reader Scope for my assigned identity permissions; it can operate in Reader Scope (for inspection and telemetry analysis) or Privileged Scope (to execute changes and automated mitigations).
Automate Incidents: When an alert fires, the agent queries monitoring platforms, correlates signals across systems, determines probable root causes, and suggests or executes fixes
Automate Scheduled Workflows: It can perform scheduled background tasks, such as routine health checks and compliance sweeps
Investigate and Advise (Virtual Team Member): Engineers can ask natural-language questions (e.g., "what changed in the last hour?") in chat interfaces like Microsoft Teams to get grounded operational insights.
Instead of forcing engineers to manually correlate disparate data, the agent follows a streamlined incident workflow: when an alert fires (in Azure Monitor, in my case), the SRE agent picks it up. It queries logs using correlation IDs to connect the data so that the agent can do the Root Cause Analysis & Ticketing: The agent identifies the probable cause (such as a bad commit or memory trend) and can prefill an incident ticket in ServiceNow or PagerDuty with diagnostic findings
The support engineer, in this case me, reviews and approves the remediation.
Connects natively with Azure Monitor, Application Insights, Log Analytics, PagerDuty, ServiceNow, GitHub, and Azure DevOps
Tip: External tools can also connect via the Model Context Protocol (MCP), basically making any API accessible.
Customisation: Capabilities can be extended using Skills (Azure CLI scripts and marketplace runbooks), Python tools, Custom sub-agents, and Agent hooks
Billing: Operational reasoning is metered using Agentic Units (AUs) rather than standard raw tokens, with standard monthly allocations; I still have no idea what this will cost or how it is calculated.
The Microsoft Azure SRE Agent provides a structured, governed way to use AI for incident management. By pulling together context from observability tools and code repositories into a single thread, it reduces tool switching and speeds resolution.
One Azure Dashboard for all Subscriptions in Your Azure Tenant
A production subscription. A development environment. A Microsoft for Startups sponsorship. Perhaps a Visual Studio subscription, a trial subscription, or a subscription dedicated to experimentation.
The information you need is scattered across Azure:
💰 Cost Management for spend
📦 Resource Graph for inventory
💳 Billing for credits and subscriptions
🔍 Individual subscription pages for everything else
I wanted a single place to answer three simple questions:
✅ What is running?
✅ What is it costing?
✅ How much Azure credit is left?
This solution creates an Azure Portal dashboard covering every subscription in a tenant. Barclays Eagle Labs is amazing for startups, and they have helped me immensely, including getting Microsoft Startup Credits, and I think this will help a lot of people with their Startups.
• Monthly cost per subscription
• Resource counts by subscription
• Resources grouped by type
• Complete resource inventory across all subscriptions
• Subscription offer type (Pay-As-You-Go, Sponsorship, Visual Studio, etc.)
• Billing account details
• Remaining Azure credit and expiry dates where available
• Direct links into Subscription Overview and Cost Analysis
1. Download the file:
New-SubscriptionsDashboard.ps12. Open Azure Cloud Shell and select PowerShell
3. Upload the New-SubscriptionsDashboard.ps1 file into your Cloud Shell home directory
4. Get your tenant ID, set the dashboard location and run the creation PowerShell script:
Current position: Signalling has traditionally been set at the national level, which is hard to integrate when trains cross borders. It is expensive and harder to make interoperable.
EULYNX specifications cover the following subsystems:
15 key partners are: DB InfraGO (Germany), Network Rail/GBR (UK), SNCF (France), RFI (Rete Ferroviaria Italiana), ÖBB (Austria), ProRail (Netherlands), Infrabel(Belgium), Croatia, Czech Republic, Finland, Luxembourg, Norway, Slovenia, Sweden, and Switzerland.
Understanding Railways Series:
UK Railway Industry for Dummies, focusing on Rail Infrastructure
Railway Infrastructure - Signalling
EULYNX Signalling (this post)
Elevator Pitch - 30 seconds
Tip: Don't let it drag on - get it done fast, 3- 6 months max.
Tip: Raise investment as late as possible.
Tip: Build my investment strategy before looking for investors.
Tip: The investor must fit with the startup
Tip: UKPostbox.com apparently offer good services for registered offices.
"Delaware flip" is how a startup can switch to being incorporated in Delaware. Delaware company owns the original company.
IP: Business & IP Centre
Recommended to me:
Zero to One by Blake Masters & Peter Thiel book
Overview: Automation testing using AI generally ends with "test rot". Kaizen Fix gets around test rot by switching the test source from the analysed system requirements to the code source as the logic to test.
Why: Gathering requirements in Agile software is continuously changing, so building tests based on the ask coupled with AI updating code realistically means the behaviour will change, DOM/Shaow DOM updating per build, and the full code base needs to be retested to ensure operational behaviour.
Hypothesis: Break the E2E testing into two distinct parts:
1) Does what the user asked for match what is delivered? Ask AI to document the requirement from the code and compare it to the requirement the stakeholder signed off on.
2) When code is updated, does this break any existing logic? Regression tests to check existing logic work; if not, this requires a man in the loop to validate the change.
Proposed Solution:
The four-step loop: 1. Code with AI → 2. Generate the code specification → 3. Tests generated by AI and MCP → 4. Test Baselines (run the dynamic Playwright test suites). As the release occurs, the developer can automatically run the old tests and identify what is no longer working and why. This can also be run during development. I've been working on this different approach: an AI-assisted testing framework that treats the source code as the single source of truth — and turns it into a living, executable specification.
Key Point: reruns against the original/previous baseline catch genuine behaviour changes, not test rot. I deliberately left it unbranded so you can drop in KaizenFix (or keep it vendor-neutral) depending on where you're posting it.
How it works, in four steps:
1. Read the AI-generated code
AI (Claude or GitHub Copilot, working inside the IDE) analyses the application's source — components, routes, validation, business logic — and generates a full behavioural specification: what the system does today, fully documented, straight from the code.
2. Turn behaviour into programmed behaviour requirements
That specification becomes a structured requirements document. Not aspirational requirements — actual behaviour. If the app rounds a value, enforces a limit, or hides a button under a condition, it's captured.
3. Generate the regression suite
From the actual requirements into Playwright tests. AI generates detailed Playwright end-to-end tests — using platform-specific best practices for selectors and patterns, and environment configuration so the same suite runs against dev, UAT, or production. Each web app lives as its own isolated project with its own context and rules.
4. Lock in the baseline
At this point, the tests and the app agree by construction — the suite documents and validates the working behaviour. The tests part of the documentation.
The payoff comes when things change:
When the app or its logic evolves, rerun the original suite. Anything that breaks is a genuine, intentional-or-not change in behaviour — surfaced immediately, with the old expected values as evidence. Regenerate the spec, diff it against the last one, and you can see exactly what changed and whether you meant it.
Amended +- June 2026 with Picture below: Source unknown
GitHub Copilot, Claude Code, and Cursor are not AI models! They are Coding Agents/Assistants.
They are the developer experience layer that sits in your IDE and seamlessly accesses various Large Language Models (LLMs) such as Claud Opus/Fable/Sonnet/Haiku or GPT5.
The actual intelligence comes from the underlying Large Language Model (LLM) such as GPT-5, Claude Opus/Sonnet, Gemini,
Naming breakdown:
VS Code / Visual Studio /Claude Code (IDE)
─────▼────
GitHub Copilot / Cursor Extension / Claude Code Extension (Coding Agent)
─────▼────
GPT-5 / Claude Opus / Gemini (LLMs)
Local vs Premium LLMS:
Cursor can reference online LLMs like Claude Opus and use Ollama to run Qwen3-Coder (my pref. for now), DeepSeek-Coder, Llama 3.x, Mistral. Ollama lets me point to a local LLM and use it for free (saving on tokens; there are other advantages as well).
My Setup for local LLM usage:
 |
| The Feedback app, in production, is showing the availability tests run recently |
CI: I decided to use Azure Container Jobs to run the Playwright tests on a Docker image.
Web applications generally fall into the CSR or SSR.
| Feature | Client-Side Rendering (CSR) | Server-Side Rendering (SSR) |
|---|---|---|
| Rendering location | Browser | Server |
| Initial page load | Slower | Faster |
| SEO | Worse | Better |
| Server workload | Lower | Higher |
| Browser workload | Higher | Lower |
| Typical use | Internal apps, dashboards | Public websites, e-commerce |
| System Classification |
|
|
The table is worth understanding as it affects architectural decisions as the project progresses.
Code Apps (Power Platform) look to be gaining momentum. I think they will work for corporate app development as they offer governance and ALM as part of the Power Platform. I saw this summary and thought it was a great overview.
A decade ago, the companies that used Agile processes along these lines built the best software using CI/CD, and Automated Testing were the big winners.
5 Years ago, low-code and platforms provided governance and faster ways to build apps.
We are seeing AI coming into all 6 steps, and low code is optional; it still offers good governance for businesses.
Overview: I have found that many people don't understand what Anthropic and Claude do, how they relate to each other, or how they fit into the AI industry.
The key takeaway is that Claude has two main parts: Tooling (e.g., Claude AI chat, Claude code, and Claude Cowork), and models for AI. The main product lines for these LLMs are Opus, Sonnet, and Haiku.
Overview: I have seen people really struggling with understanding that Claude is not GitHub Copilot (GHCP). And GitHub Copilot is not an LLM.
Terminology:
Claude by Anthropic is made up of various parts, and it helps to be more specific. Calusde is amazing at providing great Large Language Models (LLMs). There are Claude Opus (for programming the lastest us 4.7), Claud Sonnet, and Claude Haiku. GPT-5.4 is OpenAI's current flagship LLM. Gemini 3.1 Pro is known for UI-focused coding. I found Gemini 3.0 good, but I don't use it that often.
Claude also offers other services beyond supplying LLMs like Claude Code and Claude CLI. These are the key ones for me:
GitHub Copilot for VS Code is the equivalent of Claude Code for VS Code
Developing in VS Code:
In the screen below, I am using both Claude Code and GitHub Copilot in the VS Code IDE.
Overview: I have been using Copilot Studio for production solutions for a few weeks now, and I am impressed. I pushed my fist Copilot Studio custom agent from using ALM into QA and Production, where I finished the iteration a week ago. My boss was looking at the Agent in SharePoint and identified a bug with uploading files and using them.
Anyway, I tested the scenario in other channels and in the Test area without issue. In SharePoint, a Custom Copilot Agent can't upload a file to work with OOTB.
Medium- and large-sized IT projects often run into trouble at various points. This analogy has helped me keep projects online and delivered, so I thought I'd share.
Firstly, for those who don't know in depth about chess strategy, it generally goes something like this:
Here is an Overview of Azure Networking:
Overview: MS Graph and OAuth permissions must be assigned via Entra ID (IdP) App Registrations.
App registration - is the definition of an app (API permissions it exposes, scopes, app roles, redirect URIs, etc.).
Enterprise Application (Service principal) - the instance of that app in the Entra tenant, created after consent is granted.
Consent is granted to an Enterprise Application instance/service principal, not by an app registration.
1. Register a new App Reg in Entra ID
PS>
Install-Module PnP.PowerShell -Scope CurrentUser
PS> Connect-PnPOnline
-Url https://radimaging.sharepoint.com/sites/Contracts -ClientID <xxx-xxx> -Interactive
 |
PS> Grant-PnPAzureADAppSitePermission -AppId "8f468b7c-9APP-YOU-WANT-TO-GRANT" -DisplayName "My App" -Site "https://<tenant>.sharepoint.com/sites/<site>" -Permissions Write
Tip: You may want "Read" instead of "Write" permissions or another higher level.
5. When you access the Site for the first time, you will be asked to provide consent (the administrator can also consent on behalf of business users).
6. Verify that within Portal.azure.com > Enta ID > Manage > Enterprise Applications (find the app reg that has been consented to)
7. Connect to the site using Postman or any client to verify you have the access you need.
I’m a big fan of using GitHub Copilot with VS Code. Right now, my preferred LLM is Claude Opus 4.5 — it’s so good.
Anyway, these are my notes and findings for using GHCP:
Custom Agents are built for a specific role or working style. You select an agent when you want Copilot to follow a particular set of instructions and use dedicated tools tailored to that job.
Agent Skills, on the other hand, are reusable capabilities. They bundle instructions, scripts, and resources that Copilot can automatically draw on whenever they’re relevant—no need for you to choose or switch anything manually.
Overview: My system notified me that my production errors were going crazy. Quickly I knew all the tenants at my largest customer were down.
Problem: Apps would load and stay in a loading state. I could see the Canvas apps but that is where is would continue try to load.
Initial Hypothesis: Originally, I thought is was 1 environment and I know it was loading a SharePoint list so i thought it may be permissions, but it was on all my environments and my continuous test was picking them all up.
I checked the Microsoft Services and all the services are working: https://azure.status.microsoft/en-gb/status
I went to QA and Dev and they were also failing with the same issue. I ran the Canvas app in debug mode and could see the error was relating to Connectors to the European APIM for Dataverse.
Next I went to other environments on my client in other regions, they too were also failing. I was a bit surprised as I wasn't getting any feedback from other clients, or feeds, so i logged onto my own company Power Platform tenant and in environments, they were working. So this was only to this specific client. And now I knew the extent, and i could not run flows only on the client environments.
Here are the CI test report and results for a subset of the apps on the business units production environment.
Ran a test to check a single Production department Environment with 24 Canvas apps:
 | ||||
Simple test: runs on 3 worker processes on a single browser engine chromium.
All 8 tests were not finding the Title of the page. I log from Playwright and from Canvas apps using App Insight traces, the error was supper easy to pickup even without the Power Platform trace in the Dev environment. Resolution: Raise a ticket, tell MS that we had the issue and provide the info (not raised by me, but by a support engineer). 30 minutes later, the company has been advised to close the browsers and try again. Did this manually and issue resolved. I still had the old token for SPO in Playwright for Chromium, so I ran the test on for all 3 browser engines. Chromium fails with the old token, Firefox and webkit pass as they grabbed new login tokens.
If I find out what cause the issue, I'll post what MS did and found out. Useful Dashboards I used:  Portal.azure.com OOTB App Insights Url to retrieve an OperationIDs' history https://portal.azure.com/#blade/HubsExtension/BladeRedirect/bladeName/Microsoft_Azure_LogicAppsRunBlade/ runId/<OPERATION_ID>/ logicAppName/<LOGIC_APP_NAME>/ resourceGroupId/%2Fsubscriptions%2F<SUBSCRIPTION_ID> %2FresourceGroups%2F<RESOURCE_GROUP_NAME>%2Fproviders%2FMicrosoft.Logic%2Fworkflows%2F<LOGIC_APP_NAME>  Series App Insights for Power Platform - Part 1 - Series Overview App Insights for Power Platform - Part 2 - App Insights and Azure Log Analytics App Insights for Power Platform - Part 3 - Canvas App Logging (Instrumentation key) App Insights for Power Platform - Part 4 - Model App Logging App Insights for Power Platform - Part 5 - Logging for APIM App Insights for Power Platform - Part 6 - Power Automate Logging App Insights for Power Platform - Part 7 - Monitoring Azure Dashboards App Insights for Power Platform - Part 8 - Verify logging is going to the correct Log analytics App Insights for Power Platform - Part 9 - Power Automate Licencing App Insights for Power Platform - Part 10 - Custom Connector enable logging App Insights for Power Platform - Part 11 - Custom Connector Behaviour from Canvas Apps Concern App Insights for Power Platform - Part 12 - A fix story (this post) |
Microsoft Fabric get all its data from OneLake. I believe all storage, except Real Time Intelligence (RTI), uses OneLake to ensure there is only one copy of the data.
Left side of the diagram/Data sources:
Any data source - copy data from any source into a Lakehouse, and the Parquet and Delta is stored in OneLake and exposed via the Catalog Layer
Mirroring: Some data sources are mirrored into OneLake Parquet, including Snowflake, PostgreSQL, and Azure SQL 2025.
MS Fabric SQL is part of Fabric, and the SQL database is mirrored into OneLake.
Shortcuts - 3rd party software holds the parquet* data and allows MS Fabric to query the data.
Overview: Snowflake covers a small area of what Fabric does. But Snowflake cover it's area unbelievably well. For large enterprises use these together even though there is some overlap, Snowflake is great at what it does!
Five ways to use Snowflake data in Fabric:
1. ETL - use Data Factory or an ETL tool to copy data from Snowflake to Fabrics OneLake (point in time copy). This should be your last option.
2. Direct query (no copy) - Fabric compute (Power BI, Notebooks, Dataflows, Pipelines) runs queries directly against Snowflake’s SQL endpoint. Best when you want zero‑copy and Snowflake stays the system of record.
3. Mirroring (copy + sync) - Fabric mirrors a Snowflake database using CDC into OneLake so Fabric can work locally with governed, accelerated data while staying synced with Snowflake. Good for small and commonly accessed data.
4. Shortcut to Snowflake‑hosted Iceberg (no data copy) - Fabric creates a Shortcut (virtual pointer) to Iceberg tables stored with Snowflake, so Fabric tools read them without moving data.
5. Snowflake writes Iceberg to OneLake - Like option 3 but Snowflake handle the outbound - Snowflake materializes Iceberg tables into a OneLake location; Fabric then reads them natively (open‑format interop).
SharePoint has added some great AI components when coupled with M365 Copilot. We have had this for a few weeks in GA:
The Summarize feature is fantastic:
There is no MS Graph API yet for this functionality, so I used Playwright to scrape the summaries and add them to a summary metadata field. I came across Knowledge Agent, which is in public preview, and it is fantastic.
 |
| Knowledge Agent in the SPO UI |
