Duncan Ndegwa

API security SDK with credential isolation and automated closed-loop threat response. Patent pending. #APISecurtiy #DevSecurity.

[Duncan Ndegwa @DevFortressNet]

5/5:
full breakdown: https://t.co/S6PuhUy0WG

npm install [email protected]
textbook + demos: https://t.co/mYhQP5Ij4G

#APISecurityArchitecture #DevSecOps

[Duncan Ndegwa @DevFortressNet]

1/5:
SpyCloud found 18.1 million exposed API keys in criminal markets this year. the number gets attention. the reason it keeps happening doesn't. 🧵

[Duncan Ndegwa @DevFortressNet]

4/5:
real credentials should never leave the application that owns them. the monitoring layer should receive an alias — a random string that authenticates nothing if the platform is breached.

[Duncan Ndegwa @DevFortressNet]

Want the full architecture?

📖 Textbook — 34 inventions, full technical depth:
https://t.co/mYhQP5Ij4G

📬 Weekly series — one invention per week, with code:
https://t.co/3aTOma7UCa

[Duncan Ndegwa @DevFortressNet]

1/6:
One week ago we launched DevFortress.

The most common response: "I want to try it but cannot justify a subscription yet."

Today we answer that. DevFortress Open Core is live. 🧵

[Duncan Ndegwa @DevFortressNet]

Two launches.

Platform launch.
Open core launch.

https://t.co/UrOE6GQak0

Core inventions patent-pending. KIPI KE/P/2026/005970–005973.

[Duncan Ndegwa @DevFortressNet]

@BruzWJ @sukh_saroy Most teams treat OAuth token storage
as an infrastructure problem.

It is actually a security boundary decision.

Who can read that token? Which services touch it?
Is there an audit trail on downstream calls?

Self-hosted moves the storage.
Not the responsibility.

[Duncan Ndegwa @DevFortressNet]

@BruzWJ @sukh_saroy Nango handles the integration errors well.

The undiscussed cost: what happens to those OAuth tokens
after successful auth.

Token stored. Proxy running. Requests flowing.
No behavioral visibility on downstream calls.

Self-hosted means that security posture
is now your problem

[Duncan Ndegwa @DevFortressNet]

Full thread 👆 — 5 volumes, 34 inventions,
interactive demos. https://t.co/mYhQP5Ij4G

[Duncan Ndegwa @DevFortressNet]

I spent a year documenting the security architecture
nobody was building.

Not a blog post. Not a whitepaper.

5 volumes. 12 chapters. 34 patented inventions.

A complete textbook on token-aliased closed-loop API security.

Here's what I found while writing it. 🧵

[Duncan Ndegwa @DevFortressNet]

If you're building APIs, handling OAuth tokens,
or securing AI agents — this is the implementation guide.

5 volumes. Interactive demo access included.

https://t.co/mYhQP5Ij4G

[Duncan Ndegwa @DevFortressNet]

I built this as a solo founder in Nairobi.

4 patent filings. Then the SDK. Then the platform.

The textbook documents everything —
the math, the architecture, the implementation.

[Duncan Ndegwa @DevFortressNet]

@sukh_saroy Nango solves auth beautifully.

The unsolved layer: behavioral monitoring

on those tokens post-auth.

Who's watching what authenticated requests

actually do after handshake?

That's where the real production risk lives.