C-TPO

Cookies

Last updated October 13, 2026

The short version. The only cookies on this site are Google Analytics cookies, and they're only set if you say yes. Say no and there are none. The site also counts visits with Vercel Web Analytics, which uses no cookies at all; the privacy page has the details.

Cookies, only with your OK

NameSet byWhat it's forLasts
_gaGoogle AnalyticsA random ID so visits can be counted without knowing who you are13 months
_ga_<id>Google AnalyticsKeeps track of the current visit13 months

Google Signals and ad personalization are off, so this data isn't used for advertising.

Stored in your browser, not cookies

NameWhat it's forLasts
ctpo-consentRemembers your yes or no on analytics, so you aren't asked on every pageUntil you clear it
ctpo-offer-seenRemembers you've seen the airline ad, so it doesn't pop up againUntil you clear it
ctpo-readRemembers which pieces you've started or read, so cards can say New, Started, Read, or Updated since you read itUntil you clear it
ctpo-subscribedRemembers that you signed up for the newsletter here, or came from a newsletter link, so the sign-up box says you're on the list instead of asking againUntil you clear it
ctpo-usefulRemembers which take-homes you've marked useful, so the button shows as yoursUntil you clear it
ctpo-heartsRemembers which roadmap notes you've hearted, so the hearts show as yoursUntil you clear it

These stay on your device and are never sent to me or anyone else.

Changing your mind

Use "Cookie settings" at the bottom of any page. If you switch analytics off, the Google Analytics cookies are removed and it stops loading. You can also block or clear cookies in your browser settings, and the site works the same either way. If your browser sends a Global Privacy Control signal, analytics stays off and you won't be asked.

Questions: privacy@ctpo.io. More on data in general is on the privacy page.

For people short on time

TL;DR

Matt thinks out loud here about technology, mostly how teams decide what to build, fix and protect.

The first series argues that security gets better fastest when the teams that each hold part of the answer share it earlier. Part 2 says most critical findings aren't: seven questions tell you which, and the answers live with other teams. Clay first, chisel later is about roughing out the whole thing before polishing the parts.

Every piece says how much AI helped, and the site changes in the open. The discussion happens on LinkedIn.

Start with Part 1 β†’
AI score 2/4 me. Idea 1.5/2 Β· Words 0.5/2. AI drafted these from what's on the site; I haven't rewritten them yet

Updated October 14, 2026. A TL;DR for the whole site, by reader, is an idea by Matt at ctpo.io. Copy it freely, just link back.