Books
5 books by Kubilay Tunca, covering the same ground as this blog at the length the subject actually needs. Each book page says plainly who the book is for and who should skip it, so you can rule one out in thirty seconds rather than after buying it.
As an Amazon Associate I earn from qualifying purchases. Buying through these links costs you nothing extra and helps pay for the blog.
-
The Digital Fortress
Your Everyday Guide to a Safer Digital Life · Second Edition
Stay Safe Online Without Making It Your Second Job
A warm, plain-English guide for people with real lives and finite patience. Learn the handful of habits that genuinely protect your money, accounts, and family, and get honest permission to ignore the rest.
Skip it if: If you already use a password manager, hardware security keys, and have thought about your own threat model, this book will read as revision. Start with Secure Software Development or The Anonymity Playbook instead.
-
The Anonymity Playbook
Digital Survival for Whistleblowers, Journalists, Activists, and Everyone Else · Second Edition
For People Who Cannot Afford to Get Privacy Wrong
A practitioner’s field manual for journalists protecting sources, whistleblowers, and activists. It explains how the surveillance actually works, what each technique costs you, and exactly where it fails.
Skip it if: This is not a manual for evading a lawful investigation, and it does not pretend to be one. It assumes a lawful reader with a legitimate need for privacy, and it is explicit throughout about where each technique fails — including against adversaries it cannot defeat.
-
Secure Software Development
Practical patterns for building secure software
Write, Ship, and Maintain Code Without Shipping Vulnerabilities
A hands-on security guide for developers and IT professionals who ship real software. Build, deploy, and maintain secure systems without slowing down or drowning in theory.
Skip it if: This is not a certification study guide and it does not map to exam objectives. It is also not a penetration-testing book — the perspective throughout is the person building the system, not the person attacking it.
-
The Secure Harness
Shipping Production Code with AI Coding Agents
Use AI Coding Agents Without Losing Control of Your Codebase
A calm, practical guide to letting agents do useful work inside boundaries you set, enforce, and audit. Ships with 15 copy-pasteable artifacts: hook scripts, permission configs, release gates, and MCP templates.
Skip it if: This is not a prompt-engineering book, and it will not make an agent better at writing code. It also assumes you want a human in the loop — if the goal is a fully autonomous pipeline with no review gate, its recommendations will read as friction.
-
The AI Native Engineer
Build, Evaluate, and Ship AI Systems That Work in Production
Stop Shipping Demos. Start Shipping Systems.
Sixteen hands-on chapters, one real product. Grow it from a single model call into a retrieved, tool-using, observable, production-grade system, with evaluation treated as a habit from the first feature.
Skip it if: This is not about training or fine-tuning models from scratch, and there is no CUDA in it. If you are doing research rather than building on top of existing models, it is aimed elsewhere.