[ security engineer · seattle · est. 2016 ]
Abhishek
Reddy
Security engineer in Seattle. I work on platform security — identity, cryptography, and the boundaries between services — and write about building systems that fail safe instead of failing open.
- Cloudflare
- Stripe
- HashiCorp
- Okta
- SPIFFE
Now
Currently a Staff Security Engineer working on workload identity and service-to-service trust — think SPIFFE/SPIRE, mTLS meshes, and the PKI that sits underneath them. Before that: cloud infrastructure security and a lot of Go and C++ in production.
I care about controls that are boring on purpose — the kind that keep working at 3am when the person who built them is asleep.
Writing
Security writeups and notes. Generalizable lessons, not internal details.
- Fail closed: default-deny as a design discipline A control that fails open is a control that isn't there when it matters. Notes on building systems where the error path is also the safe path.
- Certificate rotation that doesn't page you at 3am Most mTLS outages aren't attacks — they're expiry. A few design choices turn rotation from a recurring incident into a non-event.
Selected work
Papers, talks, and disclosures.
- Workload Identity at Scale: Lessons from Running SPIRE in Production SecurityConf 2025 · A field report on operating a SPIFFE/SPIRE deployment across thousands of workloads — issuance, rotation, and the failure modes that only show up at scale.
- CVE-2024-00000 — Privilege escalation via unvalidated SPIFFE ID in a service mesh sidecar Coordinated disclosure · Placeholder entry. A sidecar accepted an identity document without fully validating its trust domain, allowing a workload to impersonate a peer. Replace with your real disclosure or delete.