# CTPO

> Writing on technology, product, and the decisions in between. Written by Matt, in the open, with AI as a sparring partner. Every piece carries an AI score: how much of it is mine.

The views here are my own, not my employer's. Quoting with a link back is welcome.

## Writing

- [Security is a group project, part 2.5: No name, no score, no fix](https://www.ctpo.io/writing/security-is-a-group-project-part-2-and-a-half.md): A new kind of finding is showing up: flaws found by AI reading the code itself. They arrive with no ID, no score and no fix. What that does to the seven questions, and why it makes sharing early matter even more. A bonus part: it wasn't in the plan, and the plan had to change.
- [Security is a group project, part 3: Who may act, and who may know](https://www.ctpo.io/writing/security-is-a-group-project-part-3.md): Sharing the answers doesn't mean everyone gets to see everything, or touch anything. Knowing and acting are two different permissions, every answer is a claim someone stands behind, and the details of an open flaw stay need-to-know. Part 3 of 4.
- [Security is a group project, part 4: A path, not a verdict](https://www.ctpo.io/writing/security-is-a-group-project-part-4.md): Today a finding gets a verdict on day one, with the least information it will ever have. A path is different: the finding moves, picks up answers along the way, and the call changes when the facts do. One made-up finding, followed to the end, with everyone's part in it. Part 4 of 4.
- [Clay first, chisel later](https://www.ctpo.io/writing/clay-first-chisel-later.md): Start with a little more than you need, roughed out as a whole. Then cut. AI changed what that costs.
- [Security is a group project, part 1: The bet](https://www.ctpo.io/writing/security-is-a-group-project-part-1.md): The biggest gain in security right now is easy to miss from inside any one team. Part 1 of 4: the problem, the hypothesis, and three ways it can go.
- [Security is a group project, part 2: Seven questions](https://www.ctpo.io/writing/security-is-a-group-project-part-2.md): Most critical findings aren't. Qualify with prejudice: seven questions decide which ones earn a place on the list, and almost none of the answers live with security. They need to arrive early. Part 2 of 4.

## How the site is run

- [Roadmap](https://www.ctpo.io/roadmap): Now, Next and Later, then the full board
- [Changelog](https://www.ctpo.io/changelog): every change, with a monthly review
- [How I use AI](https://www.ctpo.io/how-i-use-ai): what the AI score means
- [Credits](https://www.ctpo.io/credits): what feeds it, makes it and runs it
- [Operatie Klompje](https://www.ctpo.io/operatie-klompje): product discovery for one customer, my mom, in the open

## For machines

- [Site index (JSON)](https://www.ctpo.io/site-index.json): pieces, notes, the roadmap and monthly reviews
- [MCP server](https://www.ctpo.io/api/mcp): read-only, Streamable HTTP, no sign-in. Tools: list_pieces, get_piece, search, get_roadmap, get_notes, get_monthly_review
- [RSS](https://www.ctpo.io/rss.xml)