[{"data":1,"prerenderedAt":11667},["ShallowReactive",2],{"all-blog-posts":3,"people":11575},[4,210,596,757,1148,1329,1838,3428,3622,4898,5085,5199,5562,5838,6126,6284,6438,6528,6679,6947,7094,7284,7477,7733,7930,8248,8891,9126,9250,9721,9889,10514,10658,11095,11223],{"id":5,"title":6,"author":7,"body":8,"date":195,"description":196,"excerpt":197,"extension":198,"eyebrow":199,"heroImage":200,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":203,"navigation":201,"path":204,"seo":205,"slug":206,"stem":207,"subHeadline":208,"tags":197,"__hash__":209},"blog\u002Fblog\u002Fa-story-about-missing-context.md","A Story About Missing Context","devin-bernosky",{"type":9,"value":10,"toc":183},"minimark",[11,15,18,21,23,26,28,33,36,39,42,45,48,50,53,55,58,60,63,65,69,72,77,80,83,86,89,92,95,98,102,105,108,111,115,118,121,124,127,130,134,137,140,143,146,149,152,158,163,168,173,176],[12,13,14],"p",{},"Your phone buzzes. PagerDuty. You're immediately awake, heart racing - this is the call no service owner wants at 2:45 AM.",[16,17],"hr",{},[12,19,20],{},"The alert is clear but concerning: your payment processor queue has been backing up for 45 minutes. Hundreds of thousands of dollars in transactions are sitting in limbo. As you frantically log in, another alert: customer support is being flooded with reports of failed checkouts.",[16,22],{},[12,24,25],{},"This is the moment when every service owner feels that familiar knot in their stomach. Your status dashboards show the queue growing steadily. The payment processor's status page shows all systems operational. But something is clearly wrong.",[16,27],{},[29,30,32],"h2",{"id":31},"the-traditional-debugging-dance","The Traditional Debugging Dance:",[12,34,35],{},"You check the logs: 10,000 entries, a mix of warnings and errors",[12,37,38],{},"You need more detail, but raising the log level requires a service restart",[12,40,41],{},"A restart means dropping your in-memory cache - making a bad situation worse",[12,43,44],{},"Even if you deploy new logging code, you risk overwhelming your production systems",[12,46,47],{},"Meanwhile, the queue keeps growing",[16,49],{},[12,51,52],{},"The worst part? You can't see what's actually happening in those API calls. Your logging system isn't set up to store complete payloads. You're flying blind, trying to piece together what's happening from fragmented error codes and metadata.",[16,54],{},[12,56,57],{},"Time is ticking. Every minute means more failed transactions, more frustrated customers, more revenue at risk. You start weighing impossible tradeoffs: risk a deployment to add more logging? Try to reproduce in staging? Wake up more of the team?",[16,59],{},[12,61,62],{},"This is a story about missing context. The critical information about what's actually flowing between your service and your payment processor exists - it's there on the wire - but traditional tools can't capture it safely or show it to you when you need it most.",[16,64],{},[29,66,68],{"id":67},"this-is-why-we-built-qpoint","This is why we built Qpoint.",[12,70,71],{},"Because when critical systems fail, context shouldn't be your bottleneck.",[73,74,76],"h3",{"id":75},"imagine-that-same-scenario-with-the-complete-context-qpoint-provides","Imagine that same scenario with the complete context Qpoint provides:",[12,78,79],{},"Your phone buzzes at 2:45 AM",[12,81,82],{},"You log into Qpoint's Command Center",[12,84,85],{},"Immediately you see the failing payment processor endpoint",[12,87,88],{},"One click shows you the exact API payloads causing issues",[12,90,91],{},"You can see which processes are making the calls",[12,93,94],{},"You spot the pattern: successful responses are taking 30+ seconds, causing timeouts in your retry logic",[12,96,97],{},"In seconds, the true nature of the problem becomes clear: your retry logic is timing out before the payment processor can respond, triggering additional retries - which puts even more load on an already slow endpoint. It's a perfect storm of cascading failures that would be nearly impossible to spot without payload-level visibility.",[73,99,101],{"id":100},"with-the-root-cause-identified-the-fix-becomes-straightforward","With the root cause identified, the fix becomes straightforward:",[12,103,104],{},"Adjust retry timeouts to account for the slower response times",[12,106,107],{},"Implement exponential backoff to prevent overwhelming the endpoint",[12,109,110],{},"Add circuit breaking to fail fast when the processor is struggling",[73,112,114],{"id":113},"without-this-visibility-youd-likely-spend-hours","Without this visibility, you'd likely spend hours:",[12,116,117],{},"Adding more logging",[12,119,120],{},"Deploying instrumentation changes",[12,122,123],{},"Trying to reproduce the issue in staging",[12,125,126],{},"Wondering if it was a network issue, a code bug, or a third-party problem",[12,128,129],{},"This is the power of complete context. No service restarts. No code deployments. No compromising security. Just immediate visibility into what's actually happening between your service and its dependencies.",[73,131,133],{"id":132},"and-this-visibility-transforms-how-teams-debug-issues","And this visibility transforms how teams debug issues:",[12,135,136],{},"Debug with confidence: See the actual request and response payloads causing issues, without adding logging code or restarting services",[12,138,139],{},"Understand the source: Know exactly which processes, containers, and services are making calls",[12,141,142],{},"Spot patterns instantly: Identify rate limiting, authentication issues, or payload problems immediately",[12,144,145],{},"Protect sensitive data: Capture critical debugging information without exposing it in general logging systems",[12,147,148],{},"As organizations scale, this kind of visibility becomes crucial. The engineer who built the payment integration might be fast asleep in another timezone. Your cloud ops team needs to understand issues across dozens of services they didn't build. Complete context becomes not just valuable - it becomes essential.",[12,150,151],{},"That's the fundamental difference between traditional observability and complete context. Traditional tools give you logs, metrics, and traces. But Qpoint shows you what's actually happening on the wire, at the source, before traffic leaves your environment. We capture the context that other tools miss, enabling you to:",[12,153,154],{},[155,156,157],"strong",{},"Resolve incidents faster",[12,159,160],{},[155,161,162],{},"Reduce mean time to resolution",[12,164,165],{},[155,166,167],{},"Get back to building features instead of debugging",[12,169,170],{},[155,171,172],{},"Sleep better knowing you have visibility when you need it",[12,174,175],{},"The next time your phone buzzes at 2:45 AM, you'll have the context you need to solve problems quickly. Because the truth is on the wire - you just need a way to see it.",[12,177,178],{},[179,180],"img",{"alt":181,"src":182},"Phone.sheep.small","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.04.15.a.story\u002F6daa9c33-cfab-433a-9b82-098f6afb5e34.jpg",{"title":184,"searchDepth":185,"depth":185,"links":186},"",2,[187,188],{"id":31,"depth":185,"text":32},{"id":67,"depth":185,"text":68,"children":189},[190,192,193,194],{"id":75,"depth":191,"text":76},3,{"id":100,"depth":191,"text":101},{"id":113,"depth":191,"text":114},{"id":132,"depth":191,"text":133},"2025-04-15","Learn how a lack of visibility into external API calls can leave you flying blind during critical incidents. This story illustrates the challenges of debugging with fragmented logs and introduces a new approach to gain complete context for faster resolu",null,"md","2:45 AM","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.04.15.a.story\u002Fflaming.phone-smaller.jpg",true,false,{},"\u002Fblog\u002Fa-story-about-missing-context",{"title":6,"description":196},"a-story-about-missing-context","blog\u002Fa-story-about-missing-context","Your phone buzzes. PagerDuty. You're immediately awake, heart racing - this is the call no service owner wants at 2:45 AM","62jSwb_WA_1et6rgBKQvTP12qfIfL5GrJLDgFfdF8gE",{"id":211,"title":212,"author":7,"body":213,"date":584,"description":585,"excerpt":197,"extension":198,"eyebrow":586,"heroImage":587,"heroImageClasses":197,"heroShadow":202,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":588,"logoColor":197,"maxImgWidth":197,"meta":589,"navigation":201,"path":590,"seo":591,"slug":592,"stem":593,"subHeadline":594,"tags":197,"__hash__":595},"blog\u002Fblog\u002Fai-black-box-network-visibility.md","Are You Watching What's Leaving Your Network?",{"type":9,"value":214,"toc":571},[215,222,233,236,254,257,259,263,266,302,313,315,319,330,333,370,380,390,392,396,399,403,414,418,432,445,448,452,455,459,466,468,472,475,515,517,521,524,527,556,559,561,565,568],[12,216,217,218,221],{},"You're facing an unprecedented challenge. Business units, developers, and data science teams are in a sprint to integrate AI, embedding LLMs and AI agents into core applications. While the innovation is exciting, it has created a massive, encrypted blind spot: ",[155,219,220],{},"outbound API calls",".",[12,223,224,225,228,229,232],{},"Every time an application on your ",[155,226,227],{},"servers"," calls an external ",[155,230,231],{},"third-party"," AI service, be it OpenAI, Anthropic, or any other vendor, it sends data over HTTPS. Because this traffic is encrypted, your traditional network monitoring tools are blind to the data leaving your environment.",[12,234,235],{},"This raises uncomfortable, high-stakes questions:",[237,238,239,243,246],"ul",{},[240,241,242],"li",{},"Is proprietary source code being fed to an LLM to \"debug\" it?",[240,244,245],{},"Is sensitive customer PII being included in prompts?",[240,247,248,249,253],{},"What ",[250,251,252],"em",{},"exactly"," is that new AI agent sending to its third-party SaaS integrations?",[12,255,256],{},"For a CISO, \"I don't know\" is not an acceptable answer. The risk of unintended data leakage, compliance violations, and shadow AI usage is enormous.",[16,258],{},[29,260,262],{"id":261},"why-capturing-ai-transactions-is-harder-than-it-looks","Why Capturing AI Transactions Is Harder Than It Looks",[12,264,265],{},"To solve the AI blind spot, organizations are trying a few different methods, each with serious trade-offs.",[267,268,269,288],"ol",{},[240,270,271,274,275,278,279,282,283,287],{},[155,272,273],{},"Application-Level Logging (SDKs):"," The first approach is to ",[155,276,277],{},"rely on developers",". You ask them to manually log every AI prompt and response, or you mandate a specific AI gateway or SDK. The problem? This is a ",[155,280,281],{},"compliance nightmare",". It's an \"opt-in\" model that completely misses \"Shadow AI.\" One developer using a raw ",[284,285,286],"code",{},"curl"," or a different library, and your visibility is gone. It's not a complete security solution; it's a development guideline that's impossible to enforce.",[240,289,290,293,294,297,298,301],{},[155,291,292],{},"Inline Proxies (MITM Decryption):"," The second approach is the traditional network security model: ",[155,295,296],{},"inline proxies"," and ",[155,299,300],{},"man-in-the-middle decryption",". As you know, this is often a non-starter for modern, high-throughput production environments. These methods add latency, create single points of failure, and are a massive operational burden, especially around certificate management.",[12,303,304,305,308,309,312],{},"Neither of these methods gives you what you actually need: a ",[155,306,307],{},"complete, independent, and non-disruptive"," way to see ",[250,310,311],{},"all"," AI traffic.",[16,314],{},[29,316,318],{"id":317},"a-new-approach-visibility-at-the-source","A New Approach: Visibility at the Source",[12,320,321,322,325,326,329],{},"This is where ",[155,323,324],{},"QTap"," comes in. QTap is a lightweight, ",[155,327,328],{},"open-source"," agent that sits on your hosts (VMs, Kubernetes nodes, servers). It uses a safe, modern kernel technology called eBPF to tap into your system at the source.",[12,331,332],{},"Here's the core concept:",[237,334,335,360],{},[240,336,337,340,341,297,344,347,348,351,352,355,356,359],{},[155,338,339],{},"The \"Magic\"",": Instead of breaking TLS on the network, QTap intercepts data at the application layer by hooking into TLS library functions (like OpenSSL's ",[284,342,343],{},"SSL_read",[284,345,346],{},"SSL_write","). This allows it to see the ",[155,349,350],{},"full plaintext request and response"," ",[250,353,354],{},"before"," it's encrypted or ",[250,357,358],{},"after"," it's decrypted.",[240,361,362,365,366,369],{},[155,363,364],{},"No Disruption",": This is crucial. QTap operates ",[155,367,368],{},"out-of-band",". It stealthily mirrors the data stream, adding virtually no latency and requiring no application code changes or certificate management. Your traffic flows completely uninterrupted.",[12,371,372,373,375,376,379],{},"This is where QTap's ",[155,374,328],{}," nature gives you full flexibility. You can run it in a \"connected\" mode or in a complete ",[155,377,378],{},"offline mode",", managed only by a local YAML file. You are not locked in. QTap can even output metrics to your existing tools like Prometheus or OpenTelemetry.",[12,381,382,383,386,387,389],{},"For those who want convenience and powerful, centralized analytics, QTap can be connected to ",[155,384,385],{},"QPlane",", QPoint's optional cloud control plane. But the core power of data capture and control remains with the ",[155,388,328],{}," QTap agent in your environment.",[16,391],{},[29,393,395],{"id":394},"what-this-unlocks-for-security-compliance","What This Unlocks for Security & Compliance",[12,397,398],{},"This approach directly solves your biggest AI governance challenges.",[73,400,402],{"id":401},"_1-eliminate-the-data-leakage-blind-spot","1. Eliminate the Data Leakage Blind Spot",[12,404,405,406,409,410,413],{},"You can ",[250,407,408],{},"finally"," see exactly what data is being sent from your servers to any external AI or SaaS API. You can configure QTap policies to capture full payloads for high-risk domains (like ",[284,411,412],{},"api.openai.com","). Coupled with the QScan plugin, the system can automatically classify any outgoing payload that contains PII, credentials, or proprietary source code. This turns your data leakage risk from an unknown \"black box\" into a manageable, auditable data flow.",[73,415,417],{"id":416},"_2-manage-your-invisible-saas-supply-chain","2. Manage Your \"Invisible\" SaaS Supply Chain",[12,419,420,421,424,425,427,428,431],{},"The challenge of AI also includes the AI agents integrating with your entire SaaS ecosystem (Slack, Jira, CRMs, etc.). QTap automatically discovers and inventories ",[250,422,423],{},"every"," external ",[155,426,231],{}," service your ",[155,429,430],{},"application servers"," are contacting. When (not if) a third-party vendor reports a breach, your incident response is no longer a scramble. You can instantly see:",[237,433,434,437,440],{},[240,435,436],{},"If you were affected.",[240,438,439],{},"Which services sent data to that vendor.",[240,441,442,221],{},[250,443,444],{},"Exactly what data was exposed",[12,446,447],{},"This allows you to quantify your exposure in minutes, not weeks.",[73,449,451],{"id":450},"_3-automate-auditing-prove-data-residency","3. Automate Auditing & Prove Data Residency",[12,453,454],{},"For any CISO managing compliance (like GDPR or SOC 2), this is a game-changer. An auditor might ask, \"Can you prove no EU customer data was processed by an AI service hosted in the US?\". With QTap, you have an immutable, time-stamped audit trail of every data flow, complete with payload classifications and endpoint geolocation. You can definitively prove that regulated data never left its designated boundary.",[73,456,458],{"id":457},"_4-enable-safe-ai-innovation","4. Enable Safe AI Innovation",[12,460,461,462,465],{},"Most importantly, this technology allows you to move from being a \"blocker\" to being a ",[155,463,464],{},"\"business enabler\"",". Instead of banning new AI services out of fear, you can onboard them with a safety net of full visibility. You can give development teams the freedom to experiment, knowing you have a comprehensive log and real-time alerts to enforce safe usage guidelines.",[16,467],{},[29,469,471],{"id":470},"policy-examples-concrete-use-cases","Policy Examples (Concrete Use Cases)",[12,473,474],{},"This visibility allows you to move from passive monitoring to active, automated governance. You can create and enforce rules like:",[237,476,477,487,496,506],{},[240,478,479,482,483,486],{},[155,480,481],{},"Alert on PII Leakage:"," Automatically ",[155,484,485],{},"alert"," when any connection from your production servers to an AI service contains PII classifications, credentials, or other sensitive data.",[240,488,489,482,492,495],{},[155,490,491],{},"Govern Shadow AI:",[155,493,494],{},"capture full payloads"," for any new, unknown AI domain the first time it's seen. This creates an evidence package for you to review and approve the service or block it.",[240,497,498,501,502,505],{},[155,499,500],{},"Debug Agent Failures:"," Set a rule to capture full request and response payloads ",[250,503,504],{},"only"," for connections that result in a 4xx or 5xx error, giving developers instant context for debugging.",[240,507,508,511,512,514],{},[155,509,510],{},"Prove Data Residency:"," Log all connection metadata from your EU-based servers and ",[155,513,485],{}," if any of them establish a connection with a non-EU AI endpoint.",[16,516],{},[29,518,520],{"id":519},"a-note-on-your-data-a-security-first-architecture","A Note on Your Data: A Security-First Architecture",[12,522,523],{},"Your first question is probably: \"If this agent sees my plaintext data, where is it sending it?\"",[12,525,526],{},"This is where QTap's architecture is critical. It is built on a \"separation of data\" principle.",[237,528,529,547],{},[240,530,531,534,535,538,539,542,543,546],{},[155,532,533],{},"Sensitive Payloads",", like the actual headers and bodies, ",[155,536,537],{},"NEVER"," go to the QPlane cloud. They are sent ",[250,540,541],{},"directly"," from the QTap agent to ",[250,544,545],{},"your own"," private object storage (e.g., your S3 bucket or Azure Blob).",[240,548,549,552,553,555],{},[155,550,551],{},"Anonymized Metadata",", like IPs, ports, timings, and status codes, is the ",[250,554,504],{}," thing sent to the QPlane cloud, and only if you choose to use it for centralized dashboards and alerts.",[12,557,558],{},"Sensitive content remains within your security boundary, under your control. This model preserves data sovereignty and gives you full control, whether you use QPlane or not.",[16,560],{},[29,562,564],{"id":563},"conclusion-stop-guessing-start-knowing","Conclusion: Stop Guessing, Start Knowing",[12,566,567],{},"The rapid adoption of AI doesn't have to be a security nightmare. You can't secure what you can't see. By moving observability to the source, before encryption happens, you can finally close this critical visibility gap.",[12,569,570],{},"This approach allows you to manage risk, automate compliance, and, most importantly, confidently enable the business to innovate with AI, responsibly.",{"title":184,"searchDepth":185,"depth":185,"links":572},[573,574,575,581,582,583],{"id":261,"depth":185,"text":262},{"id":317,"depth":185,"text":318},{"id":394,"depth":185,"text":395,"children":576},[577,578,579,580],{"id":401,"depth":191,"text":402},{"id":416,"depth":191,"text":417},{"id":450,"depth":191,"text":451},{"id":457,"depth":191,"text":458},{"id":470,"depth":185,"text":471},{"id":519,"depth":185,"text":520},{"id":563,"depth":185,"text":564},"2025-11-05","Business units are racing to integrate AI, creating a massive encrypted blind spot in outbound API calls. Learn how to gain visibility into what data is being sent to external AI services without disrupting your applications.","The AI Black Box","\u002Fimages\u002F2025.Q4\u002Fblack.hole.1.retro.transparent.8.bit.png","\u002Fimages\u002F2025.Q4\u002Fblack.hole.1.retro.listing.png",{},"\u002Fblog\u002Fai-black-box-network-visibility",{"title":212,"description":585},"ai-black-box-network-visibility","blog\u002Fai-black-box-network-visibility","How Qpoint eliminates the monitoring burden and investigation complexity when external dependencies fail","ZgXxvMTG6GhRe3iE5exARGPED6zuwU9fNCs26C934cQ",{"id":597,"title":598,"author":599,"body":600,"date":746,"description":747,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":748,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":749,"meta":750,"navigation":201,"path":751,"seo":752,"slug":753,"stem":754,"subHeadline":755,"tags":197,"__hash__":756},"blog\u002Fblog\u002Fannouncing-soc-2.md","Qpoint Achieves SOC 2 Type II Compliance","jon-friesen",{"type":9,"value":601,"toc":738},[602,605,609,612,632,635,639,642,645,649,652,669,672,676,679,682,696,700,703,706,717,720,724,727],[12,603,604],{},"We're excited to announce that Qpoint has successfully achieved SOC 2 Type II compliance! This milestone represents our commitment to security, privacy, and maintaining the highest standards for protecting our customers' data.",[29,606,608],{"id":607},"what-this-means-for-our-customers","What This Means for Our Customers",[12,610,611],{},"Let's start with what matters most - what this certification actually means for you:",[267,613,614,620,626],{},[240,615,616,619],{},[155,617,618],{},"Your data is secure",": We've demonstrated that our controls and processes for handling sensitive information meet rigorous security standards",[240,621,622,625],{},[155,623,624],{},"We're accountable",": Our systems have been thoroughly tested by independent auditors over a substantial period (September 16, 2024 to February 28, 2025)",[240,627,628,631],{},[155,629,630],{},"We're transparent",": This certification validates our ongoing commitment to security best practices",[12,633,634],{},"For those unfamiliar with compliance jargon, a SOC 2 Type II attestation isn't just a one-time check of security measures. It requires ongoing adherence to stringent controls and processes over a period of time. Think of it as the difference between passing a driving test and proving you're a good driver through months of actual road time.",[29,636,638],{"id":637},"why-security-matters-for-api-visibility","Why Security Matters for API Visibility",[12,640,641],{},"Qpoint's platform provides unprecedented visibility into external service dependencies through our innovative eBPF-based technology. When you're monitoring API connections at the source level, before encryption, security isn't just a feature - it's the foundation everything else is built on.",[12,643,644],{},"Our customers trust us to see and analyze their critical API traffic. With this SOC 2 Type II attestation, we're not just saying \"trust us\" - we've proven that our security controls and practices have been rigorously validated by independent experts.",[29,646,648],{"id":647},"the-process-what-it-takes-to-achieve-soc-2-type-ii","The Process: What It Takes to Achieve SOC 2 Type II",[12,650,651],{},"As a reminder to myself: getting SOC 2 compliant is a marathon, not a sprint. Our team dedicated significant time and resources to this effort, including:",[237,653,654,657,660,663,666],{},[240,655,656],{},"Implementing comprehensive security policies and procedures",[240,658,659],{},"Establishing robust access controls and monitoring",[240,661,662],{},"Conducting regular security assessments and testing",[240,664,665],{},"Training all team members on security best practices",[240,667,668],{},"Continuously monitoring and improving our security posture",[12,670,671],{},"The audit examined our controls across multiple trust service criteria, with a particular focus on security. This validated that our Qtap agent, control plane, and overall architecture meet the stringent standards required for handling sensitive customer data.",[29,673,675],{"id":674},"whats-next-maintaining-our-commitment","What's Next: Maintaining Our Commitment",[12,677,678],{},"Compliance isn't a destination - it's a continuous journey. We'll be maintaining our SOC 2 controls and preparing for our renewal audit with a 12-month evidence collection window. This ongoing commitment ensures that our security practices remain current as our platform evolves.",[12,680,681],{},"For our customers focused on security and compliance in their own organizations, you can request our Letter of Attestation to demonstrate our compliance status. This document can be shared without an NDA in place.",[683,684,688,689],"div",{"className":685},[686,687],"flex","justify-center","\n  ",[179,690],{"src":691,"alt":692,"className":693},"\u002Fimages\u002F2025.Q4\u002Fsoc-2-type-ii.png","SOC 2 Type II Certified badge",[694,695],"h-48","mb-16",[29,697,699],{"id":698},"building-a-house-with-a-strong-foundation-security-and-visibility","Building a House with a Strong Foundation: Security and Visibility",[12,701,702],{},"One thing I've learned through years in infrastructure and monitoring: security and visibility go hand-in-hand. Much like building a house, visibility is the blueprint that shows you what to build, while security is the foundation that keeps everything stable. You can't secure what you can't see, and visibility without security creates risk.",[12,704,705],{},"That's why Qpoint's approach is so powerful. By operating directly at the source of each connection using eBPF technology, we provide:",[237,707,708,711,714],{},[240,709,710],{},"Process-level intelligence identifying exactly which processes initiate external connections",[240,712,713],{},"Visibility at the source - seeing and analyzing traffic before encryption",[240,715,716],{},"Comprehensive context that maintains service identity throughout the connection lifecycle",[12,718,719],{},"And now, with our SOC 2 Type II attestation, you can be confident that this visibility comes with validated security controls.",[29,721,723],{"id":722},"lets-celebrate-together","Let's Celebrate Together",[12,725,726],{},"I'd like to thank our team for their hard work and dedication to achieving this milestone, and our customers for their trust and support throughout this process.",[12,728,729,730,737],{},"If you'd like to learn more about our SOC 2 compliance or how Qpoint's technology can provide unprecedented visibility into your external API dependencies, please ",[731,732,736],"a",{"href":733,"rel":734},"https:\u002F\u002Fqpoint.io\u002Fcontact",[735],"nofollow","contact us"," today.",{"title":184,"searchDepth":185,"depth":185,"links":739},[740,741,742,743,744,745],{"id":607,"depth":185,"text":608},{"id":637,"depth":185,"text":638},{"id":647,"depth":185,"text":648},{"id":674,"depth":185,"text":675},{"id":698,"depth":185,"text":699},{"id":722,"depth":185,"text":723},"2025-03-18","Qpoint has achieved SOC 2 Type II compliance, demonstrating our commitment to security, privacy, and protecting customer data with independently validated controls and processes.","\u002Fimages\u002F2025.Q4\u002Fsoc-2-type-ii-badge-vertical.png",380,{},"\u002Fblog\u002Fannouncing-soc-2",{"title":598,"description":747},"announcing-soc2-type-ii-certification","blog\u002Fannouncing-soc-2","Our SOC 2 Type II attestation validates that our security controls and practices for handling sensitive API traffic meet rigorous industry standards.","f9fqbM5dX3fL1VLFyRH6pIs-em2jLU4tfudXWj2SrPM",{"id":758,"title":759,"author":7,"body":760,"date":1138,"description":1139,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":1140,"heroImageClasses":197,"heroShadow":202,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":1141,"logoColor":197,"maxImgWidth":197,"meta":1142,"navigation":201,"path":1143,"seo":1144,"slug":1145,"stem":1146,"subHeadline":197,"tags":197,"__hash__":1147},"blog\u002Fblog\u002Fbuilt-to-integrate-modular-architecture.md","Built to Integrate: Why Qpoint's Modular Architecture Matters",{"type":9,"value":761,"toc":1123},[762,765,768,772,775,778,781,785,788,792,803,807,823,827,834,841,845,848,854,860,863,868,882,887,901,904,908,911,916,927,932,935,940,943,948,951,956,959,964,967,971,974,979,982,987,990,995,998,1003,1006,1009,1013,1016,1036,1039,1043,1046,1049,1052,1055,1058,1062,1065,1068,1071,1074,1078,1081,1086,1094,1099,1107,1112,1120],[12,763,764],{},"When we started building Qpoint, we faced a critical architectural decision: should we create an all-in-one platform that tries to solve every problem, or should we build something more fundamental that could adapt to how real engineering teams actually work?",[12,766,767],{},"We chose modularity. Here's why that matters.",[29,769,771],{"id":770},"the-problem-with-complete-solutions","The Problem with \"Complete Solutions\"",[12,773,774],{},"Most security and observability vendors want you to adopt their entire stack. They'll give you visibility, but only if you route all your traffic through their proxy. They'll provide dashboards, but only if you store your data in their cloud. They'll offer analysis, but only if you let them see your sensitive payloads.",[12,776,777],{},"This creates an impossible choice for security and platform teams: accept vendor lock-in and loss of data control, or remain blind to what's happening in your encrypted traffic.",[12,779,780],{},"We built Qpoint differently.",[29,782,784],{"id":783},"three-components-three-choices","Three Components, Three Choices",[12,786,787],{},"Qpoint's architecture separates concerns at a fundamental level:",[73,789,791],{"id":790},"qtap-the-data-plane","QTap: The Data Plane",[12,793,794,795],{},"A lightweight eBPF agent that captures traffic at the Linux kernel level. QTap operates at two distinct layers: the socket layer (capturing connection metadata through kernel probes) and the TLS layer (intercepting payloads before encryption). QTap is the foundation of everything and can run completely standalone with just a YAML configuration file. No account required. No phone-home behavior. No external dependencies. This is where the actual visibility happens.\n",[179,796],{"src":797,"alt":798,"className":799},"\u002Fimages\u002F2025.Q4\u002Fqtap@2x.png","example of PII data flow",[800,801,802],"max-w-[600px]","mt-8","mb-20",[73,804,806],{"id":805},"qplane-optional-centralized-management","QPlane: Optional Centralized Management",[12,808,809,810,819],{},"A cloud-hosted management interface at app.qpoint.io that provides centralized configuration, dashboards, alerting, and team collaboration. QPlane is entirely optional. Many teams run QTap standalone and never use QPlane. But when you do connect QTap agents to QPlane, you get powerful features like real-time analytics and multi-environment visibility. Crucially, QPlane only ever sees anonymized connection metadata. The sensitive payload data stays in your environment.\n",[179,811],{"src":812,"alt":798,"className":813},"\u002Fimages\u002F2025.Q3\u002Fscreengrabs\u002Finventory.spread.jpg",[814,815,816,817,818],"border-2","border-grey-200","rounded-12","mt-6","mb-4",[179,820],{"src":821,"alt":798,"className":822},"\u002Fimages\u002F2025.Q4\u002Fcontrol.plane.large@2x.png",[814,815,816,817,802],[73,824,826],{"id":825},"qscan-optional-data-classification","QScan: Optional Data Classification",[12,828,829,830],{},"A Docker container you run in your own infrastructure that uses Microsoft Presidio to identify 20+ types of sensitive data in captured traffic. QScan processes payloads entirely within your control. Whether you use it depends on your needs.\n",[179,831],{"src":832,"alt":798,"className":833},"\u002Fimages\u002F2025.Q3\u002Fcomplicated-data-flow.png",[814,815,816,817,802],[12,835,836,837,840],{},"The key insight: ",[155,838,839],{},"QTap is the product."," QPlane and QScan are optional enhancements. You get instant visibility into encrypted traffic from day one, with or without any other components.",[29,842,844],{"id":843},"data-sovereignty-by-design","Data Sovereignty by Design",[12,846,847],{},"QTap captures two distinct types of data, each with independent storage configuration:",[12,849,850,853],{},[155,851,852],{},"Events"," (connection metadata): Anonymized information about connections including timestamps, endpoints, performance metrics, and HTTP transaction summaries. This data is generally not sensitive but provides powerful analytics and troubleshooting insights.",[12,855,856,859],{},[155,857,858],{},"Objects"," (payload content): Actual request and response data including headers and bodies, which may contain sensitive information. Objects are selectively captured based on your plugin configuration, giving you fine-grained control over what gets stored.",[12,861,862],{},"This separation is architecturally fundamental. You can route events to centralized analytics platforms while keeping objects in your own S3-compatible storage. Or send both to stdout during development. Or store everything locally in air-gapped environments. The choice is yours.",[12,864,865],{},[155,866,867],{},"Storage Options for Events:",[237,869,870,873,876,879],{},[240,871,872],{},"Console output (stdout) for immediate visibility",[240,874,875],{},"Axiom for advanced analytics and visualization",[240,877,878],{},"OpenTelemetry (OTLP) for any OTLP-compatible backend (Datadog, Honeycomb, New Relic, Grafana Cloud)",[240,880,881],{},"Your existing observability pipeline via standard log formats",[12,883,884],{},[155,885,886],{},"Storage Options for Objects:",[237,888,889,892,895,898],{},[240,890,891],{},"Console output (stdout) for development",[240,893,894],{},"Any S3-compatible storage: AWS S3, MinIO, Google Cloud Storage, Backblaze B2, Wasabi",[240,896,897],{},"Local filesystem for air-gapped environments",[240,899,900],{},"Your own storage infrastructure with custom access URLs",[12,902,903],{},"The architecture makes no assumptions about your storage or processing infrastructure. You own the data flow from kernel capture to final destination. This means you can integrate Qpoint's unmatched visibility into whatever observability, security, or compliance workflows you already have running.",[29,905,907],{"id":906},"deployment-flexibility","Deployment Flexibility",[12,909,910],{},"The modular architecture enables deployment patterns that match how real organizations operate:",[12,912,913],{},[155,914,915],{},"Emergency Debugging with QTap DevTools",[12,917,918,919,922,923,926],{},"Enable QTap DevTools with a single flag (",[284,920,921],{},"--enable-dev-tools",") for instant browser-based traffic inspection on ",[284,924,925],{},"localhost:10001",". No service restarts. No code changes. No proxies. Perfect for production incident response when you need to see what's actually happening right now. All data stays local on the server you're debugging. DevTools runs alongside any other QTap configuration, giving you real-time visibility without disrupting your existing capture and storage setup.",[12,928,929],{},[155,930,931],{},"Air-Gapped Environments",[12,933,934],{},"Run QTap standalone with YAML configuration. No external connectivity required. Perfect for highly regulated industries or environments with strict data residency requirements. You still get instant visibility into encrypted traffic, process attribution, and flexible traffic processing. Send data to stdout, local storage, or your internal log aggregation infrastructure.",[12,936,937],{},[155,938,939],{},"Distributed Self-Managed",[12,941,942],{},"Deploy QTap agents across on-prem data centers and multiple cloud providers, each with its own YAML configuration. Manage configurations through Git and deploy through your CI\u002FCD pipelines. You get unified visibility into traffic patterns without any centralized control plane. Data flows to your storage and observability infrastructure.",[12,944,945],{},[155,946,947],{},"Optional Centralized Management",[12,949,950],{},"If centralized dashboards and team collaboration become important, connect your QTap agents to QPlane. Once connected, QPlane manages your agent configurations through its cloud control plane. Configuration changes propagate automatically to all agents, giving you a unified view across your infrastructure while keeping sensitive data in environment-specific storage. This is a deliberate choice between local YAML management (GitOps-friendly) and centralized cloud control (dashboard-driven).",[12,952,953],{},[155,954,955],{},"Progressive Adoption",[12,957,958],{},"Start with QTap running locally, outputting to stdout for immediate visibility. Enable DevTools when you need to debug a specific issue. Add S3 storage when you're ready to retain payloads. Integrate with OpenTelemetry when you want to route data to your existing observability stack. Optionally connect to QPlane when you need centralized management and dashboards. Enable QScan when compliance requires sensitive data classification. Each step adds capability without forcing re-architecture.",[12,960,961],{},[155,962,963],{},"Developer-Friendly Workflows",[12,965,966],{},"Developers can test with minimal YAML configurations locally, then production deployments use the same core technology but with richer processing configurations and storage options. The learning curve is gentle because the foundation stays consistent.",[29,968,970],{"id":969},"integration-points","Integration Points",[12,972,973],{},"Modularity means Qpoint fits naturally into your existing ecosystem rather than requiring you to rebuild around it:",[12,975,976],{},[155,977,978],{},"Observability Pipelines",[12,980,981],{},"QTap outputs structured events that feed directly into your existing observability stack. Route connection events and HTTP transaction data to OpenTelemetry collectors, then to Datadog, Honeycomb, New Relic, Grafana Cloud, or Elastic. Send to Axiom for advanced analytics. Or integrate with your existing log aggregation infrastructure. You're not replacing your observability tools; you're enhancing them with unmatched visibility that other tools can't provide. The data format is yours to define, and the destination is yours to control.",[12,983,984],{},[155,985,986],{},"Security Tools",[12,988,989],{},"Captured events and classified sensitive data can trigger actions in your SIEM, ticketing systems, or incident response platforms. The audit trail of sensitive data flows becomes evidence for compliance teams, feeding directly into your existing GRC workflows. Because QTap outputs standard formats (OpenTelemetry logs, structured JSON), integration is straightforward.",[12,991,992],{},[155,993,994],{},"Storage and Compute",[12,996,997],{},"Use any S3-compatible storage: AWS S3, Google Cloud Storage, MinIO, Wasabi, Backblaze B2. Run QScan wherever makes sense: in your VPC, on-premises, in a Kubernetes cluster. Deploy QTap on bare metal, VMs, or containers. The architecture doesn't dictate your infrastructure choices.",[12,999,1000],{},[155,1001,1002],{},"CI\u002FCD and GitOps",[12,1004,1005],{},"QTap's YAML configuration is version-controlled infrastructure-as-code. For standalone deployments, commit configurations to Git, test changes in staging, and deploy through your existing CI\u002FCD pipelines. You manage QTap entirely through YAML files.",[12,1007,1008],{},"If you connect to QPlane, the cloud control plane manages your agent configurations. QPlane's Snapshot YAML feature lets you download your current configuration from the UI and commit it to version control for backup or templating purposes, but active configuration management happens either through local YAML files or through QPlane - not both simultaneously.",[29,1010,1012],{"id":1011},"the-real-world-impact","The Real-World Impact",[12,1014,1015],{},"This modularity matters because real environments are messy. You might have:",[237,1017,1018,1021,1024,1027,1030,1033],{},[240,1019,1020],{},"A payment service that needs full payload capture and PII detection",[240,1022,1023],{},"Internal microservices where you only need connection-level visibility",[240,1025,1026],{},"A third-party integration that requires detailed error logging",[240,1028,1029],{},"Compliance requirements that mandate certain data stays on-premises",[240,1031,1032],{},"A security team that wants centralized dashboards",[240,1034,1035],{},"A platform team that wants to own their configuration in Git",[12,1037,1038],{},"With Qpoint's modular architecture, you can satisfy all these requirements simultaneously. You're not forced into compromises because the architecture doesn't impose artificial constraints.",[29,1040,1042],{"id":1041},"what-we-learned","What We Learned",[12,1044,1045],{},"Building Qpoint as a modular system required more upfront architectural work than building a monolithic platform. But this investment pays off every time we work with a new customer.",[12,1047,1048],{},"When companies with strict data residency requirements evaluate us, the separation between events and objects means they can get centralized visibility while keeping all payloads in their own infrastructure.",[12,1050,1051],{},"When teams want to integrate Qpoint into their existing observability stack, the flexible data output options mean they can feed data into their existing pipelines without replacing tools that are already working.",[12,1053,1054],{},"When customers in highly regulated industries need to prove compliance, the ability to run QTap completely standalone in air-gapped environments means we can still provide value despite their restrictions.",[12,1056,1057],{},"None of these scenarios would have worked with a monolithic \"take it all or leave it\" approach.",[29,1059,1061],{"id":1060},"the-broader-principle","The Broader Principle",[12,1063,1064],{},"Modularity in security tooling reflects a fundamental respect for the complexity of real engineering environments.",[12,1066,1067],{},"Your infrastructure isn't homogeneous. Your requirements aren't universal. Your data isn't all equally sensitive. Your team doesn't all work the same way.",[12,1069,1070],{},"Any tool that pretends otherwise is trying to simplify reality rather than work within it.",[12,1072,1073],{},"We built Qpoint to work within the reality of modern infrastructure: messy, distributed, heterogeneous, and constantly evolving. The modular architecture means you can adopt what makes sense for your specific context, integrate with what you already have, and change your mind later without major disruption.",[29,1075,1077],{"id":1076},"try-it-yourself","Try It Yourself",[12,1079,1080],{},"Want to see this modularity in action?",[12,1082,1083],{},[155,1084,1085],{},"Start Standalone",[12,1087,1088,1089],{},"Deploy QTap with a minimal YAML configuration that outputs to stdout. Five minutes to visibility with zero dependencies. No account required. ",[731,1090,1093],{"href":1091,"rel":1092},"https:\u002F\u002Fdocs.qpoint.io\u002Fguides\u002Fgetting-started\u002Fqtap-starter-configuration-stdout-only",[735],"5-Minute Quickstart",[12,1095,1096],{},[155,1097,1098],{},"Add Capabilities Progressively",[12,1100,1101,1102],{},"Follow our Complete Guide that walks through four levels of configuration: basic stdout logging, S3 storage, integration with your observability stack, and production-ready configurations with conditional capture. All without requiring QPlane. ",[731,1103,1106],{"href":1104,"rel":1105},"https:\u002F\u002Fdocs.qpoint.io\u002Fguides\u002Fgetting-started\u002Fgetting-started-complete-guide",[735],"Complete Guide",[12,1108,1109],{},[155,1110,1111],{},"Or Optionally Try Centralized Management",[12,1113,1114,1115],{},"If you want to explore centralized dashboards and team collaboration, deploy with QPlane in 10 minutes. You still maintain data sovereignty through the architectural separation. ",[731,1116,1119],{"href":1117,"rel":1118},"https:\u002F\u002Fdocs.qpoint.io\u002Fguides\u002Fqplane\u002Fpoc-kick-off-guide",[735],"POC Kick Off Guide",[12,1121,1122],{},"The choice is yours. That's the (q)point.",{"title":184,"searchDepth":185,"depth":185,"links":1124},[1125,1126,1131,1132,1133,1134,1135,1136,1137],{"id":770,"depth":185,"text":771},{"id":783,"depth":185,"text":784,"children":1127},[1128,1129,1130],{"id":790,"depth":191,"text":791},{"id":805,"depth":191,"text":806},{"id":825,"depth":191,"text":826},{"id":843,"depth":185,"text":844},{"id":906,"depth":185,"text":907},{"id":969,"depth":185,"text":970},{"id":1011,"depth":185,"text":1012},{"id":1041,"depth":185,"text":1042},{"id":1060,"depth":185,"text":1061},{"id":1076,"depth":185,"text":1077},"2025-11-14","Most security vendors force you into all-or-nothing adoption. Learn why Qpoint's modular architecture (QTap, QPlane, QScan) gives you unmatched visibility with complete flexibility over data storage, deployment, and integration.","\u002Fimages\u002F2025.Q4\u002Flego.1.png","\u002Fimages\u002F2025.Q4\u002Flego.listing.png",{},"\u002Fblog\u002Fbuilt-to-integrate-modular-architecture",{"title":759,"description":1139},"built-to-integrate-modular-architecture","blog\u002Fbuilt-to-integrate-modular-architecture","Zc6EQL3efgNxLyUGE6XQRRu2cVyGGsf1yPoKqmj5kUU",{"id":1149,"title":1150,"author":1151,"body":1152,"date":1319,"description":1320,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":1321,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":1322,"navigation":201,"path":1323,"seo":1324,"slug":1325,"stem":1326,"subHeadline":1327,"tags":197,"__hash__":1328},"blog\u002Fblog\u002Fconquering-the--hidden-challenges-of-external-integrations-with-qpoint.md","Conquering the Hidden Challenges of External Service Integrations","marc-barry",{"type":9,"value":1153,"toc":1314},[1154,1157,1168,1171,1175,1178,1183,1191,1195,1198,1202,1209,1215,1223,1246,1250,1253,1256,1267,1276,1280,1283,1300],[12,1155,1156],{},"The surge in third-party integrations has introduced a host of new challenges for operators:",[237,1158,1159,1162,1165],{},[240,1160,1161],{},"Your app’s reliability now depends on the stability of external services.",[240,1163,1164],{},"Diagnosing problems now means untangling a maze of dependencies.",[240,1166,1167],{},"Blind spots in external requests and payloads are a ticking time bomb for data governance.",[12,1169,1170],{},"Legacy tools weren't built to handle the growing complexity of today’s interconnected tech landscape.",[73,1172,1174],{"id":1173},"navigating-the-challenges-of-outbound-application-traffic","Navigating the Challenges of Outbound Application Traffic",[12,1176,1177],{},"To keep your modern, highly connected applications running smoothly, it's crucial to navigate the complexities of outbound application (egress) traffic, as this is where many of the performance, security, and reliability issues begin to surface.",[1179,1180,1182],"h4",{"id":1181},"understanding-egress-traffic","Understanding Egress Traffic",[12,1184,1185,1186,1190],{},"Egress traffic, the outbound data flow from your applications to third-party APIs, managed services, and other dependencies, has become a critical component of modern application architecture. However, ",[731,1187,1189],{"href":1188},"\u002Fresources\u002Fwhy-securing-egress-traffic-matters","visibility into this egress traffic"," is often limited, leading to blind spots in managing performance and security. Traditionally, egress traffic is left largely unmonitored, with open policies that starkly contrast the tight controls placed on inbound traffic. This lack of visibility can obscure critical insights into how your application interacts with external services, making it difficult to troubleshoot issues or enforce security policies effectively.",[1179,1192,1194],{"id":1193},"limitations-of-current-approaches","Limitations of Current Approaches",[12,1196,1197],{},"Current approaches to managing egress traffic often rely on network-level controls like firewall rules and access lists, which are cumbersome and disconnected from the way developers understand their applications. These methods focus on IP addresses and CIDR notations, offering little insight into the actual behavior of outbound traffic. This disconnect leaves developers and operators blind to how protocols, domains, and libraries are interacting with external services, resulting in inefficient troubleshooting and security gaps that are difficult to close.",[1179,1199,1201],{"id":1200},"the-need-for-a-new-solution","The Need for a New Solution",[12,1203,1204,1205,1208],{},"The lack of accessible tools for managing external dependencies and traffic flows has created a significant challenge ops teams. Current solutions are complex, requiring expertise across various aspects of infrastructure and often failing to provide the real-time visibility needed by developers and operations teams. Bridging this gap with a solution that leverages enhanced visibility into egress traffic is crucial—",[731,1206,1207],{"href":1188},"not just for security",", but also for reliability and efficient troubleshooting.",[73,1210,1212],{"id":1211},"overcoming-external-service-integration-challenges-with-qpoint",[155,1213,1214],{},"Overcoming External Service Integration Challenges with Qpoint",[12,1216,1217,1218,1222],{},"Qpoint aims to bring a higher level of sophistication to how operators manage the interactions between their production applications and their external service dependencies. By enabling operators to tap into their egress traffic with cutting edge ",[731,1219,1221],{"href":1220},"\u002Fresources\u002Fwhat-is-ebpf","eBPF technology",", questions like the following can be answered:",[237,1224,1225,1228,1231,1234,1237,1240,1243],{},[240,1226,1227],{},"Which external services are my applications connecting to?",[240,1229,1230],{},"What are the payloads? Do they contain sensitive data?",[240,1232,1233],{},"What protocols are being used (TCP, HTTP, HTTPS)?",[240,1235,1236],{},"When are we connecting to previously unknown endpoints?",[240,1238,1239],{},"Which vendor is responsible for our current outage?",[240,1241,1242],{},"Are we about to be throttled due to a rate limit?",[240,1244,1245],{},"What is the set of API tokens that is currently being used for external requests?",[1179,1247,1249],{"id":1248},"powered-by-ebpf","Powered by eBPF",[12,1251,1252],{},"Qpoint leverages an eBPF probe (Qtap) to tap into your egress traffic directly on the host without affecting performance. Think of Qtap as a smart, invisible observer that watches all outgoing traffic, answering crucial questions about who's sending data, what's being sent, and where it's going. It's perfect for organizations looking to gain insights without changing their existing infrastructure.",[12,1254,1255],{},"Key benefits:",[237,1257,1258,1261,1264],{},[240,1259,1260],{},"Non-intrusive monitoring",[240,1262,1263],{},"Minimal performance impact",[240,1265,1266],{},"Comprehensive traffic visibility",[12,1268,1269,1270,1275],{},"Qtap also supports the ",[731,1271,1274],{"href":1272,"rel":1273},"https:\u002F\u002Fwww.qpoint.io\u002Fresources\u002Fhow-we-use-middleware-at-qpoint#entry:4993@1:url",[735],"Qpoint middleware engine"," which allows you to seamlessly inject custom functions and execute complex traffic manipulations out-of-band from your primary request flow.",[73,1277,1279],{"id":1278},"revolutionize-how-your-team-manages-external-service-interactions","Revolutionize How Your Team Manages External Service Interactions",[12,1281,1282],{},"As the digital landscape evolves, so must our approach to observability and data security. Qpoint offers a comprehensive solution to the often-overlooked challenge of managing the interactions between your core applications and their critical external service dependencies. By providing unprecedented visibility into outbound data flows, enabling custom controls, and offering flexible deployment options, Qpoint empowers an operations team to:",[237,1284,1285,1288,1291,1294,1297],{},[240,1286,1287],{},"Maintain an inventory of vendors that is the source of truth for the organization",[240,1289,1290],{},"Monitor traffic, detect errors, and trigger alerts in real time if there is anomalous activity",[240,1292,1293],{},"Enable developers to swiftly pinpoint and resolve production issues",[240,1295,1296],{},"Optimize performance and costs associated with external services",[240,1298,1299],{},"Ensure compliance with data protection regulations through systematic detection of sensitive data in external traffic",[12,1301,1302,1303,1308,1309,1313],{},"Don't let your external dependencies and vendor relationships remain an overlooked area of risk and lost productivity for your organization. Take the first step towards comprehensive visibility and control over your applications' interactions with external services. Visit our ",[731,1304,1307],{"href":1305,"rel":1306},"https:\u002F\u002Fdocs.qpoint.io\u002F",[735],"documentation"," to learn more or ",[731,1310,1312],{"href":1311},"\u002Fcontact","contact us today"," for a personalized demo and discover how we can tailor our solution to your specific needs.",{"title":184,"searchDepth":185,"depth":185,"links":1315},[1316,1317,1318],{"id":1173,"depth":191,"text":1174},{"id":1211,"depth":191,"text":1214},{"id":1278,"depth":191,"text":1279},"2024-09-17","Discover why implementing a traditional egress proxy is often impossible in modern microservices environments. Learn about the challenges and a new approach for visibility and control.","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.09.17\u002Fintroducing-egress-observability-listing.png",{},"\u002Fblog\u002Fconquering-the-hidden-challenges-of-external-integrations-with-qpoint",{"title":1150,"description":1320},"conquering-the--hidden-challenges-of-external-integrations-with-qpoint","blog\u002Fconquering-the--hidden-challenges-of-external-integrations-with-qpoint","What if you could get comprehensive visibility into every interaction between your applications and their external vendor dependencies? Welcome to a new era of external service visibility with eBPF.","7up7hbx1phNiij4tP0NTowB9WK8PhsJyAqeNjEL4Jvk",{"id":1330,"title":1331,"author":7,"body":1332,"date":1826,"description":1827,"excerpt":197,"extension":198,"eyebrow":1828,"heroImage":1829,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":201,"listingImage":1830,"logoColor":197,"maxImgWidth":197,"meta":1831,"navigation":201,"path":1832,"seo":1833,"slug":1834,"stem":1835,"subHeadline":1836,"tags":197,"__hash__":1837},"blog\u002Fblog\u002Febpf-npm-worm-detection.md","How eBPF-Based Egress Monitoring Would Have Caught the Shai-Hulud npm Worm in Real-Time",{"type":9,"value":1333,"toc":1810},[1334,1337,1341,1348,1351,1376,1391,1395,1398,1424,1431,1435,1441,1444,1448,1451,1477,1480,1484,1487,1508,1512,1515,1534,1538,1545,1554,1557,1571,1575,1583,1619,1622,1626,1634,1666,1669,1673,1676,1690,1693,1707,1711,1714,1728,1731,1745,1749,1752,1784,1788,1791,1800,1803,1805],[12,1335,1336],{},"September 2025 marked a watershed moment for supply chain security when the Shai-Hulud worm became the first self-replicating malware to successfully propagate through the npm ecosystem. While the security community's rapid response limited damage, the attack exposed a critical blind spot: organizations had no visibility into what their backend systems were actually sending to the internet. This post examines how Qpoint's eBPF-based data-in-motion security would have detected this attack at the moment of compromise.",[29,1338,1340],{"id":1339},"the-attack-a-self-propagating-supply-chain-nightmare","The Attack: A Self-Propagating Supply Chain Nightmare",[12,1342,1343,1344,1347],{},"On September 14, 2025, at 17:58 UTC, the npm ecosystem faced something unprecedented. Unlike previous supply chain attacks that required manual intervention, the Shai-Hulud worm contained autonomous propagation capabilities. Starting from a single compromised package (",[284,1345,1346],{},"rxnt-authentication@0.0.3","), the worm spread to over 500 packages within 48 hours.",[12,1349,1350],{},"The worm's operation was elegantly malicious:",[267,1352,1353,1360,1363,1370,1373],{},[240,1354,1355,1356,1359],{},"Execute during ",[284,1357,1358],{},"npm install"," via postinstall hooks",[240,1361,1362],{},"Harvest credentials using TruffleHog to scan for AWS keys, npm tokens, and GitHub PATs",[240,1364,1365,1366,1369],{},"Exfiltrate credentials to ",[284,1367,1368],{},"webhook.site"," endpoints",[240,1371,1372],{},"Use stolen npm tokens to automatically publish infected versions of all packages the account controlled",[240,1374,1375],{},"Create GitHub repositories containing the stolen credentials for redundant exfiltration",[12,1377,1378,1379,1382,1383,1386,1387,1390],{},"Major packages compromised included ",[284,1380,1381],{},"@ctrl\u002Ftinycolor",", multiple ",[284,1384,1385],{},"@crowdstrike"," namespace packages, and dozens of ",[284,1388,1389],{},"@nativescript-community"," packages, affecting millions of weekly downloads.",[29,1392,1394],{"id":1393},"the-blind-spot-why-traditional-security-missed-it","The Blind Spot: Why Traditional Security Missed It",[12,1396,1397],{},"The Shai-Hulud worm exploited a fundamental gap in enterprise security architecture. Most organizations have sophisticated security stacks, yet none of their tools could see what was happening:",[237,1399,1400,1406,1412,1418],{},[240,1401,1402,1405],{},[155,1403,1404],{},"Network monitoring"," saw encrypted TLS connections to webhook.site but couldn't inspect the payload",[240,1407,1408,1411],{},[155,1409,1410],{},"Endpoint detection"," logged npm installations but didn't correlate them with outbound connections",[240,1413,1414,1417],{},[155,1415,1416],{},"Cloud security platforms"," scan configurations periodically, missing real-time credential theft",[240,1419,1420,1423],{},[155,1421,1422],{},"Container security"," focused on vulnerabilities and misconfigurations, not runtime data flows",[12,1425,1426,1427,1430],{},"The core issue? ",[155,1428,1429],{},"All these tools operate at the wrong layer."," By the time network traffic is encrypted or logs are generated, the critical context is already lost.",[29,1432,1434],{"id":1433},"enter-ebpf-powerful-visibility-changes-everything","Enter eBPF: Powerful Visibility Changes Everything",[12,1436,1437,1440],{},[731,1438,1439],{"href":1220},"eBPF (extended Berkeley Packet Filter)"," operates directly in the Linux kernel, providing visibility at the exact point where applications hand data to the network stack—before TLS encryption occurs. This positioning enables something previously impossible: seeing inside encrypted connections while maintaining zero performance impact.",[12,1442,1443],{},"Here's what Qpoint's eBPF-based egress monitoring would have observed during the Shai-Hulud infection:",[73,1445,1447],{"id":1446},"detection-point-1-credential-exfiltration","Detection Point 1: Credential Exfiltration",[12,1449,1450],{},"When the worm's postinstall script executed, eBPF would have captured:",[237,1452,1453,1459,1465,1471],{},[240,1454,1455,1458],{},[155,1456,1457],{},"Process context",": npm install → node → postinstall script",[240,1460,1461,1464],{},[155,1462,1463],{},"Connection details",": Outbound HTTPS to webhook.site",[240,1466,1467,1470],{},[155,1468,1469],{},"Payload content",": AWS credentials, npm tokens, GitHub PATs (before encryption)",[240,1472,1473,1476],{},[155,1474,1475],{},"Behavioral anomaly",": Package installation sending credentials to external domain",[12,1478,1479],{},"This combination—a package manager sending authentication tokens to webhook.site—is never legitimate. Detection would be instant and unambiguous.",[73,1481,1483],{"id":1482},"detection-point-2-worm-propagation-attempts","Detection Point 2: Worm Propagation Attempts",[12,1485,1486],{},"As the worm attempted to spread, eBPF would have observed:",[237,1488,1489,1495,1502,1505],{},[240,1490,1491,1492],{},"Node.js process making authenticated calls to ",[284,1493,1494],{},"api.npmjs.org",[240,1496,1497,1498,1501],{},"POST requests to ",[284,1499,1500],{},"\u002Fpackage\u002F"," endpoints (publishing new versions)",[240,1503,1504],{},"npm authentication tokens in the request headers",[240,1506,1507],{},"Critical pattern: Package installation publishing new packages",[73,1509,1511],{"id":1510},"detection-point-3-cloud-secret-harvesting","Detection Point 3: Cloud Secret Harvesting",[12,1513,1514],{},"The worm's attempts to enumerate cloud secrets would trigger immediate detection:",[237,1516,1517,1523,1528,1531],{},[240,1518,1519,1520],{},"Connections to ",[284,1521,1522],{},"secretsmanager.us-east-1.amazonaws.com",[240,1524,1519,1525],{},[284,1526,1527],{},"secretmanager.googleapis.com",[240,1529,1530],{},"AWS and GCP credentials in request payloads",[240,1532,1533],{},"Suspicious pattern: npm process accessing cloud secret stores",[29,1535,1537],{"id":1536},"the-power-of-process-to-network-attribution","The Power of Process-to-Network Attribution",[12,1539,1540,1541,1544],{},"The key advantage of eBPF-based monitoring is ",[155,1542,1543],{},"complete process lineage",". You don't just see that webhook.site received data; you see the entire chain:",[1546,1547,1552],"pre",{"className":1548,"code":1550,"language":1551},[1549],"language-text","npm install @ctrl\u002Ftinycolor\n  └── spawns: node (PID 4892)\n      └── executes: postinstall.js\n          └── connects to: webhook.site\n              └── sends: AWS_ACCESS_KEY=AKIA...\n","text",[284,1553,1550],{"__ignoreMap":184},[12,1555,1556],{},"This attribution is crucial. Many applications legitimately connect to external services, but a package installation process should never:",[237,1558,1559,1562,1565,1568],{},[240,1560,1561],{},"Send credentials to webhook domains",[240,1563,1564],{},"Publish new npm packages during installation",[240,1566,1567],{},"Query cloud secret management APIs",[240,1569,1570],{},"Create GitHub repositories with credential data",[29,1572,1574],{"id":1573},"real-time-classification-seeing-secrets-in-motion","Real-Time Classification: Seeing Secrets in Motion",[12,1576,1577,1578,1582],{},"Qpoint's ",[731,1579,1581],{"href":1580},"\u002Fproducts\u002Fqscan","Qscan classification engine"," uses a hybrid approach combining deterministic pattern matching with machine learning to identify sensitive data in real-time:",[237,1584,1585,1595,1604,1613],{},[240,1586,1587,1590,1591,1594],{},[155,1588,1589],{},"AWS Access Keys",": ",[284,1592,1593],{},"AKIA[0-9A-Z]{16}"," patterns",[240,1596,1597,1590,1600,1603],{},[155,1598,1599],{},"npm Tokens",[284,1601,1602],{},"npm_[a-zA-Z0-9]{36}"," format",[240,1605,1606,1590,1609,1612],{},[155,1607,1608],{},"GitHub PATs",[284,1610,1611],{},"ghp_[a-zA-Z0-9]{36}"," structure",[240,1614,1615,1618],{},[155,1616,1617],{},"API Keys",": High-entropy strings with known prefixes",[12,1620,1621],{},"This classification happens on your infrastructure, analyzing the data before it's encrypted and leaves your network. The moment Shai-Hulud attempted to exfiltrate its first credential, the attack would be detected.",[29,1623,1625],{"id":1624},"why-speed-matters-the-detection-timeline","Why Speed Matters: The Detection Timeline",[12,1627,1628,1629,1633],{},"With ",[731,1630,1632],{"href":1631},"\u002Fproducts\u002Fqtap","Qtap's eBPF monitoring",", the Shai-Hulud detection timeline would look like this:",[237,1635,1636,1642,1648,1654,1660],{},[240,1637,1638,1641],{},[155,1639,1640],{},"T+0 seconds",": npm install executes malicious postinstall",[240,1643,1644,1647],{},[155,1645,1646],{},"T+2 seconds",": First webhook.site connection detected",[240,1649,1650,1653],{},[155,1651,1652],{},"T+2.5 seconds",": Credentials identified in outbound payload",[240,1655,1656,1659],{},[155,1657,1658],{},"T+3 seconds",": Behavioral anomaly flagged (npm → webhook.site with secrets)",[240,1661,1662,1665],{},[155,1663,1664],{},"T+5 seconds",": Automated alerts sent to team for triage",[12,1667,1668],{},"Compare this to the actual timeline where the worm operated undetected for hours, spreading to 500+ packages before discovery.",[29,1670,1672],{"id":1671},"beyond-detection-quantifying-supply-chain-risk","Beyond Detection: Quantifying Supply Chain Risk",[12,1674,1675],{},"Qpoint doesn't just detect attacks—it continuously quantifies your supply chain risk by maintaining a real-time inventory of:",[237,1677,1678,1681,1684,1687],{},[240,1679,1680],{},"Every third-party service your backend systems connect to",[240,1682,1683],{},"What type of data flows to each service",[240,1685,1686],{},"Which processes initiate these connections",[240,1688,1689],{},"When new, unexpected connections appear",[12,1691,1692],{},"For Shai-Hulud, this would mean:",[237,1694,1695,1698,1701,1704],{},[240,1696,1697],{},"Immediate identification of webhook.site as a new, suspicious third party",[240,1699,1700],{},"Classification showing credentials being sent (critical risk)",[240,1702,1703],{},"Process attribution revealing npm packages as the source",[240,1705,1706],{},"Automated risk scoring flagging this as highest priority",[29,1708,1710],{"id":1709},"the-fundamental-shift-from-perimeter-to-data-centric-security","The Fundamental Shift: From Perimeter to Data-Centric Security",[12,1712,1713],{},"The Shai-Hulud worm demonstrates why the future of security is data-centric rather than perimeter-centric. In modern cloud-native environments:",[237,1715,1716,1719,1722,1725],{},[240,1717,1718],{},"There is no perimeter—workloads run everywhere",[240,1720,1721],{},"Encryption is ubiquitous—you can't inspect network traffic",[240,1723,1724],{},"Attacks originate from within—via compromised dependencies",[240,1726,1727],{},"Speed is critical—attacks propagate in seconds, not hours",[12,1729,1730],{},"Qpoint's eBPF-based data-in-motion security addresses all these challenges by:",[237,1732,1733,1736,1739,1742],{},[240,1734,1735],{},"Operating wherever Linux runs (cloud, containers, VMs)",[240,1737,1738],{},"Capturing data before encryption at the kernel level",[240,1740,1741],{},"Providing complete process-to-network visibility",[240,1743,1744],{},"Enabling real-time detection and response",[29,1746,1748],{"id":1747},"lessons-for-security-teams","Lessons for Security Teams",[12,1750,1751],{},"The Shai-Hulud attack offers clear lessons for security teams:",[267,1753,1754,1760,1766,1772,1778],{},[240,1755,1756,1759],{},[155,1757,1758],{},"You can't secure what you can't see",". If you don't know what data your systems are sending to which third parties, you're flying blind.",[240,1761,1762,1765],{},[155,1763,1764],{},"Process context is critical",". A connection to webhook.site might be suspicious; npm sending credentials there is definitely an attack.",[240,1767,1768,1771],{},[155,1769,1770],{},"Real-time matters",". The worm spread to 500+ packages in 48 hours. Detection after the fact is failure.",[240,1773,1774,1777],{},[155,1775,1776],{},"Supply chain attacks are data exfiltration attacks",". The goal isn't to break your system—it's to steal your credentials and data.",[240,1779,1780,1783],{},[155,1781,1782],{},"Traditional tools weren't built for this",". Network monitoring, SIEM, and cloud security platforms all have their place, but they can't see inside encrypted backend data flows.",[29,1785,1787],{"id":1786},"the-path-forward","The Path Forward",[12,1789,1790],{},"The September 2025 npm attacks weren't the first supply chain compromises, and they won't be the last. As attackers evolve from simple package poisoning to self-replicating worms, our security architectures must evolve too.",[12,1792,1793,1796,1797],{},[731,1794,1795],{"href":1631},"Qpoint's eBPF-based data-in-motion security"," represents this evolution—providing the visibility needed to see what's actually happening in your production environment. It fills the critical gap existing tools can't address: ",[155,1798,1799],{},"what sensitive data is flowing from your backend systems to the internet, right now.",[12,1801,1802],{},"The Shai-Hulud worm proved that sophisticated supply chain attacks can propagate faster than human response times. The question for security teams is simple: Do you have visibility into your data in motion, or are you waiting for the next webhook.site to appear in your logs—after the damage is done?",[16,1804],{},[12,1806,1807],{},[250,1808,1809],{},"In a world where every dependency is a potential threat vector, the ability to see and classify data in motion is the foundation for supply chain defense. The kernel doesn't lie, and with Qpoint, neither does your security posture.",{"title":184,"searchDepth":185,"depth":185,"links":1811},[1812,1813,1814,1819,1820,1821,1822,1823,1824,1825],{"id":1339,"depth":185,"text":1340},{"id":1393,"depth":185,"text":1394},{"id":1433,"depth":185,"text":1434,"children":1815},[1816,1817,1818],{"id":1446,"depth":191,"text":1447},{"id":1482,"depth":191,"text":1483},{"id":1510,"depth":191,"text":1511},{"id":1536,"depth":185,"text":1537},{"id":1573,"depth":185,"text":1574},{"id":1624,"depth":185,"text":1625},{"id":1671,"depth":185,"text":1672},{"id":1709,"depth":185,"text":1710},{"id":1747,"depth":185,"text":1748},{"id":1786,"depth":185,"text":1787},"2025-09-26","September 2025 marked a watershed moment for supply chain security when the Shai-Hulud worm became the first self-replicating malware to propagate through the npm ecosystem. This post examines how Qpoint's eBPF-based data-in-motion security would have detected this attack at the moment of compromise.","Supply Chain Security","\u002Fimages\u002F2025.Q3\u002Finfinitiy-worm.9.png","\u002Fimages\u002F2025.Q3\u002Fshai-hulu.5.png",{},"\u002Fblog\u002Febpf-npm-worm-detection",{"title":1331,"description":1827},"ebpf-npm-worm-detection","blog\u002Febpf-npm-worm-detection","The first self-replicating npm worm exposed a critical blind spot: organizations had no visibility into what their backend systems were actually sending to the internet","rdViDCvqT3LLllYP7SmGvF_B2J_g-SLb_TElOyOaSfE",{"id":1839,"title":1840,"author":599,"body":1841,"date":3418,"description":3419,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":3420,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":3421,"logoColor":197,"maxImgWidth":197,"meta":3422,"navigation":201,"path":3423,"seo":3424,"slug":3425,"stem":3426,"subHeadline":3419,"tags":197,"__hash__":3427},"blog\u002Fblog\u002Febpf-safety-in-production.md","The eBPF Verifier - How Linux Safely Runs User Code in Kernel Space",{"type":9,"value":1842,"toc":3393},[1843,1846,1849,1853,1856,1876,1879,1883,1888,1892,1895,2050,2053,2057,2141,2144,2155,2158,2162,2334,2337,2351,2355,2358,2487,2491,2494,2497,2508,2512,2515,2519,2522,2604,2607,2611,2614,2719,2779,2782,2793,2796,2800,2803,2807,2865,2884,2888,2937,2952,2956,3012,3017,3028,3033,3044,3048,3124,3139,3143,3146,3150,3161,3165,3171,3175,3186,3190,3193,3265,3268,3279,3282,3286,3291,3294,3320,3331,3335,3338,3341,3344,3346,3369,3380,3389],[12,1844,1845],{},"Running arbitrary code in kernel space. If you've been in operations long enough, that sentence probably just triggered your fight-or-flight response. And for good reason—kernel modules have been causing production outages since before containers were cool.",[12,1847,1848],{},"But eBPF is different. Not \"marketing different\" but architecturally, fundamentally, mathematically different. Today we're going to dig deep into how the Linux kernel can safely run user-supplied programs without risking system stability. This isn't about any specific tool or vendor—it's about understanding why eBPF has become the kernel's preferred extension mechanism.",[29,1850,1852],{"id":1851},"the-challenge-extending-the-kernel-without-breaking-it","The Challenge: Extending the Kernel Without Breaking It",[12,1854,1855],{},"The Linux kernel needs to be extensible. Whether it's for observability, networking, or security, we need ways to add functionality without recompiling the kernel or loading risky modules. Historically, we had three options:",[267,1857,1858,1864,1870],{},[240,1859,1860,1863],{},[155,1861,1862],{},"Kernel modules",": 😱 Full access, full risk",[240,1865,1866,1869],{},[155,1867,1868],{},"Userspace polling",": 😴 Safe but slow",[240,1871,1872,1875],{},[155,1873,1874],{},"Kernel patches",": 😰 Safe-ish but requires recompilation",[12,1877,1878],{},"Each approach involved trading off between safety, performance, and flexibility. Then eBPF came along and changed the game entirely.",[29,1880,1882],{"id":1881},"the-ebpf-architecture-verified-code-in-a-sandbox","The eBPF Architecture: Verified Code in a Sandbox",[12,1884,1885,1887],{},[731,1886,1439],{"href":1220}," allows you to run custom programs in kernel space, but with a twist: every program must pass through a verifier that proves it's safe before it can run. Let's break down how this works.",[73,1889,1891],{"id":1890},"the-verifier-your-mathematical-proof-of-safety","The Verifier: Your Mathematical Proof of Safety",[12,1893,1894],{},"The eBPF verifier is the heart of what makes eBPF safe. It's not just a linter or static analyzer—it's an abstract interpreter that simulates all program paths to ensure safety. Here's what it checks:",[1546,1896,1900],{"className":1897,"code":1898,"language":1899,"meta":184,"style":184},"language-c shiki shiki-themes github-dark-default github-light github-dark-default","\u002F\u002F Example: The verifier tracks EVERY possible code path\nvoid* ptr = map_lookup_elem(&my_map, &key);\n\u002F\u002F The verifier knows ptr might be NULL\nif (condition) {\n    \u002F\u002F Path 1: verifier tracks that we checked ptr\n    if (ptr != NULL) {\n        value = *ptr;  \u002F\u002F Safe: verifier knows ptr is valid here\n    }\n} else {\n    \u002F\u002F Path 2: different code path\n    value = *ptr;  \u002F\u002F REJECTED: ptr might be NULL on this path\n}\n","c",[284,1901,1902,1911,1949,1954,1963,1969,1988,2005,2011,2023,2029,2044],{"__ignoreMap":184},[1903,1904,1907],"span",{"class":1905,"line":1906},"line",1,[1903,1908,1910],{"class":1909},"soxxa","\u002F\u002F Example: The verifier tracks EVERY possible code path\n",[1903,1912,1913,1917,1921,1924,1928,1931,1934,1938,1941,1943,1946],{"class":1905,"line":185},[1903,1914,1916],{"class":1915},"sLAjK","void*",[1903,1918,1920],{"class":1919},"s0zXF"," ptr ",[1903,1922,1923],{"class":1915},"=",[1903,1925,1927],{"class":1926},"sZ-og"," map_lookup_elem",[1903,1929,1930],{"class":1919},"(",[1903,1932,1933],{"class":1915},"&",[1903,1935,1937],{"class":1936},"sUydE","my_map",[1903,1939,1940],{"class":1919},", ",[1903,1942,1933],{"class":1915},[1903,1944,1945],{"class":1936},"key",[1903,1947,1948],{"class":1919},");\n",[1903,1950,1951],{"class":1905,"line":191},[1903,1952,1953],{"class":1909},"\u002F\u002F The verifier knows ptr might be NULL\n",[1903,1955,1957,1960],{"class":1905,"line":1956},4,[1903,1958,1959],{"class":1915},"if",[1903,1961,1962],{"class":1919}," (condition) {\n",[1903,1964,1966],{"class":1905,"line":1965},5,[1903,1967,1968],{"class":1909},"    \u002F\u002F Path 1: verifier tracks that we checked ptr\n",[1903,1970,1972,1975,1978,1981,1985],{"class":1905,"line":1971},6,[1903,1973,1974],{"class":1915},"    if",[1903,1976,1977],{"class":1919}," (ptr ",[1903,1979,1980],{"class":1915},"!=",[1903,1982,1984],{"class":1983},"sCeZ-"," NULL",[1903,1986,1987],{"class":1919},") {\n",[1903,1989,1991,1994,1996,1999,2002],{"class":1905,"line":1990},7,[1903,1992,1993],{"class":1919},"        value ",[1903,1995,1923],{"class":1915},[1903,1997,1998],{"class":1915}," *",[1903,2000,2001],{"class":1919},"ptr;",[1903,2003,2004],{"class":1909},"  \u002F\u002F Safe: verifier knows ptr is valid here\n",[1903,2006,2008],{"class":1905,"line":2007},8,[1903,2009,2010],{"class":1919},"    }\n",[1903,2012,2014,2017,2020],{"class":1905,"line":2013},9,[1903,2015,2016],{"class":1919},"} ",[1903,2018,2019],{"class":1915},"else",[1903,2021,2022],{"class":1919}," {\n",[1903,2024,2026],{"class":1905,"line":2025},10,[1903,2027,2028],{"class":1909},"    \u002F\u002F Path 2: different code path\n",[1903,2030,2032,2035,2037,2039,2041],{"class":1905,"line":2031},11,[1903,2033,2034],{"class":1919},"    value ",[1903,2036,1923],{"class":1915},[1903,2038,1998],{"class":1915},[1903,2040,2001],{"class":1919},[1903,2042,2043],{"class":1909},"  \u002F\u002F REJECTED: ptr might be NULL on this path\n",[1903,2045,2047],{"class":1905,"line":2046},12,[1903,2048,2049],{"class":1919},"}\n",[12,2051,2052],{},"The verifier performs several types of analysis:",[1179,2054,2056],{"id":2055},"_1-control-flow-analysis","1. Control Flow Analysis",[1546,2058,2060],{"className":1897,"code":2059,"language":1899,"meta":184,"style":184},"\u002F\u002F The verifier ensures no infinite loops\nfor (int i = 0; i \u003C 100; i++) {  \u002F\u002F OK: bounded loop\n    \u002F\u002F do work\n}\n\nwhile (condition) {  \u002F\u002F REJECTED: unbounded loop\n    \u002F\u002F this will never load\n}\n",[284,2061,2062,2067,2107,2112,2116,2121,2132,2137],{"__ignoreMap":184},[1903,2063,2064],{"class":1905,"line":1906},[1903,2065,2066],{"class":1909},"\u002F\u002F The verifier ensures no infinite loops\n",[1903,2068,2069,2072,2075,2078,2081,2083,2086,2089,2092,2095,2098,2101,2104],{"class":1905,"line":185},[1903,2070,2071],{"class":1915},"for",[1903,2073,2074],{"class":1919}," (",[1903,2076,2077],{"class":1915},"int",[1903,2079,2080],{"class":1919}," i ",[1903,2082,1923],{"class":1915},[1903,2084,2085],{"class":1983}," 0",[1903,2087,2088],{"class":1919},"; i ",[1903,2090,2091],{"class":1915},"\u003C",[1903,2093,2094],{"class":1983}," 100",[1903,2096,2097],{"class":1919},"; i",[1903,2099,2100],{"class":1915},"++",[1903,2102,2103],{"class":1919},") {",[1903,2105,2106],{"class":1909},"  \u002F\u002F OK: bounded loop\n",[1903,2108,2109],{"class":1905,"line":191},[1903,2110,2111],{"class":1909},"    \u002F\u002F do work\n",[1903,2113,2114],{"class":1905,"line":1956},[1903,2115,2049],{"class":1919},[1903,2117,2118],{"class":1905,"line":1965},[1903,2119,2120],{"emptyLinePlaceholder":201},"\n",[1903,2122,2123,2126,2129],{"class":1905,"line":1971},[1903,2124,2125],{"class":1915},"while",[1903,2127,2128],{"class":1919}," (condition) {",[1903,2130,2131],{"class":1909},"  \u002F\u002F REJECTED: unbounded loop\n",[1903,2133,2134],{"class":1905,"line":1990},[1903,2135,2136],{"class":1909},"    \u002F\u002F this will never load\n",[1903,2138,2139],{"class":1905,"line":2007},[1903,2140,2049],{"class":1919},[12,2142,2143],{},"The verifier builds a complete control flow graph and ensures:",[237,2145,2146,2149,2152],{},[240,2147,2148],{},"Every path through the program terminates",[240,2150,2151],{},"No backward jumps that could create infinite loops (unless bounded)",[240,2153,2154],{},"Maximum instruction count isn't exceeded (1 million for privileged programs)",[12,2156,2157],{},"Note: The instruction count limit is higher for privileged programs—up to 1 million instructions. For unprivileged programs, it is typically limited to 10,000.",[1179,2159,2161],{"id":2160},"_2-memory-safety-verification","2. Memory Safety Verification",[1546,2163,2165],{"className":1897,"code":2164,"language":1899,"meta":184,"style":184},"\u002F\u002F The verifier tracks the size and validity of every memory region\nstruct sk_buff *skb = ctx;  \u002F\u002F ctx is validated by program type\n\n\u002F\u002F Verifier knows skb->data and skb->data_end boundaries\nvoid *data = (void *)(long)skb->data;\nvoid *data_end = (void *)(long)skb->data_end;\n\n\u002F\u002F Must check bounds before access\nif (data + sizeof(struct ethhdr) > data_end)\n    return DROP;  \u002F\u002F Verifier requires this check\n\nstruct ethhdr *eth = data;  \u002F\u002F Now safe to access\n",[284,2166,2167,2172,2194,2198,2203,2236,2264,2268,2273,2299,2310,2314],{"__ignoreMap":184},[1903,2168,2169],{"class":1905,"line":1906},[1903,2170,2171],{"class":1909},"\u002F\u002F The verifier tracks the size and validity of every memory region\n",[1903,2173,2174,2177,2180,2183,2186,2188,2191],{"class":1905,"line":185},[1903,2175,2176],{"class":1915},"struct",[1903,2178,2179],{"class":1919}," sk_buff ",[1903,2181,2182],{"class":1915},"*",[1903,2184,2185],{"class":1919},"skb ",[1903,2187,1923],{"class":1915},[1903,2189,2190],{"class":1919}," ctx;",[1903,2192,2193],{"class":1909},"  \u002F\u002F ctx is validated by program type\n",[1903,2195,2196],{"class":1905,"line":191},[1903,2197,2120],{"emptyLinePlaceholder":201},[1903,2199,2200],{"class":1905,"line":1956},[1903,2201,2202],{"class":1909},"\u002F\u002F Verifier knows skb->data and skb->data_end boundaries\n",[1903,2204,2205,2208,2210,2213,2215,2217,2219,2221,2224,2227,2230,2233],{"class":1905,"line":1965},[1903,2206,2207],{"class":1915},"void",[1903,2209,1998],{"class":1915},[1903,2211,2212],{"class":1919},"data ",[1903,2214,1923],{"class":1915},[1903,2216,2074],{"class":1919},[1903,2218,2207],{"class":1915},[1903,2220,1998],{"class":1915},[1903,2222,2223],{"class":1919},")(",[1903,2225,2226],{"class":1915},"long",[1903,2228,2229],{"class":1919},")skb",[1903,2231,2232],{"class":1915},"->",[1903,2234,2235],{"class":1919},"data;\n",[1903,2237,2238,2240,2242,2245,2247,2249,2251,2253,2255,2257,2259,2261],{"class":1905,"line":1971},[1903,2239,2207],{"class":1915},[1903,2241,1998],{"class":1915},[1903,2243,2244],{"class":1919},"data_end ",[1903,2246,1923],{"class":1915},[1903,2248,2074],{"class":1919},[1903,2250,2207],{"class":1915},[1903,2252,1998],{"class":1915},[1903,2254,2223],{"class":1919},[1903,2256,2226],{"class":1915},[1903,2258,2229],{"class":1919},[1903,2260,2232],{"class":1915},[1903,2262,2263],{"class":1919},"data_end;\n",[1903,2265,2266],{"class":1905,"line":1990},[1903,2267,2120],{"emptyLinePlaceholder":201},[1903,2269,2270],{"class":1905,"line":2007},[1903,2271,2272],{"class":1909},"\u002F\u002F Must check bounds before access\n",[1903,2274,2275,2277,2280,2283,2286,2288,2290,2293,2296],{"class":1905,"line":2013},[1903,2276,1959],{"class":1915},[1903,2278,2279],{"class":1919}," (data ",[1903,2281,2282],{"class":1915},"+",[1903,2284,2285],{"class":1915}," sizeof",[1903,2287,1930],{"class":1919},[1903,2289,2176],{"class":1915},[1903,2291,2292],{"class":1919}," ethhdr) ",[1903,2294,2295],{"class":1915},">",[1903,2297,2298],{"class":1919}," data_end)\n",[1903,2300,2301,2304,2307],{"class":1905,"line":2025},[1903,2302,2303],{"class":1915},"    return",[1903,2305,2306],{"class":1919}," DROP;",[1903,2308,2309],{"class":1909},"  \u002F\u002F Verifier requires this check\n",[1903,2311,2312],{"class":1905,"line":2031},[1903,2313,2120],{"emptyLinePlaceholder":201},[1903,2315,2316,2318,2321,2323,2326,2328,2331],{"class":1905,"line":2046},[1903,2317,2176],{"class":1915},[1903,2319,2320],{"class":1919}," ethhdr ",[1903,2322,2182],{"class":1915},[1903,2324,2325],{"class":1919},"eth ",[1903,2327,1923],{"class":1915},[1903,2329,2330],{"class":1919}," data;",[1903,2332,2333],{"class":1909},"  \u002F\u002F Now safe to access\n",[12,2335,2336],{},"For every memory access, the verifier ensures:",[237,2338,2339,2342,2345,2348],{},[240,2340,2341],{},"Pointers are valid (not NULL unless explicitly checked)",[240,2343,2344],{},"Array bounds are respected",[240,2346,2347],{},"Stack doesn't overflow (512 bytes limit)",[240,2349,2350],{},"No out-of-bounds reads or writes",[1179,2352,2354],{"id":2353},"_3-type-and-context-tracking","3. Type and Context Tracking",[12,2356,2357],{},"The verifier maintains a state machine that tracks the type and range of every register and stack slot at every program point:",[1546,2359,2361],{"className":1897,"code":2360,"language":1899,"meta":184,"style":184},"\u002F\u002F Verifier tracks types through the program\nint key = 5;\nstruct value *val;\n\n\u002F\u002F After this call, verifier knows val might be NULL\nval = bpf_map_lookup_elem(&my_map, &key);\n\n\u002F\u002F Type confusion is impossible - verifier tracks that val\n\u002F\u002F is either NULL or a pointer to struct value\nif (val) {\n    \u002F\u002F Verifier knows val is non-NULL here\n    val->counter++;  \u002F\u002F Safe\n}\n\u002F\u002F Verifier knows val might be NULL here\n\u002F\u002F val->counter++;  \u002F\u002F Would be REJECTED\n",[284,2362,2363,2368,2383,2395,2399,2404,2428,2432,2437,2442,2449,2454,2467,2472,2478],{"__ignoreMap":184},[1903,2364,2365],{"class":1905,"line":1906},[1903,2366,2367],{"class":1909},"\u002F\u002F Verifier tracks types through the program\n",[1903,2369,2370,2372,2375,2377,2380],{"class":1905,"line":185},[1903,2371,2077],{"class":1915},[1903,2373,2374],{"class":1919}," key ",[1903,2376,1923],{"class":1915},[1903,2378,2379],{"class":1983}," 5",[1903,2381,2382],{"class":1919},";\n",[1903,2384,2385,2387,2390,2392],{"class":1905,"line":191},[1903,2386,2176],{"class":1915},[1903,2388,2389],{"class":1919}," value ",[1903,2391,2182],{"class":1915},[1903,2393,2394],{"class":1919},"val;\n",[1903,2396,2397],{"class":1905,"line":1956},[1903,2398,2120],{"emptyLinePlaceholder":201},[1903,2400,2401],{"class":1905,"line":1965},[1903,2402,2403],{"class":1909},"\u002F\u002F After this call, verifier knows val might be NULL\n",[1903,2405,2406,2409,2411,2414,2416,2418,2420,2422,2424,2426],{"class":1905,"line":1971},[1903,2407,2408],{"class":1919},"val ",[1903,2410,1923],{"class":1915},[1903,2412,2413],{"class":1926}," bpf_map_lookup_elem",[1903,2415,1930],{"class":1919},[1903,2417,1933],{"class":1915},[1903,2419,1937],{"class":1936},[1903,2421,1940],{"class":1919},[1903,2423,1933],{"class":1915},[1903,2425,1945],{"class":1936},[1903,2427,1948],{"class":1919},[1903,2429,2430],{"class":1905,"line":1990},[1903,2431,2120],{"emptyLinePlaceholder":201},[1903,2433,2434],{"class":1905,"line":2007},[1903,2435,2436],{"class":1909},"\u002F\u002F Type confusion is impossible - verifier tracks that val\n",[1903,2438,2439],{"class":1905,"line":2013},[1903,2440,2441],{"class":1909},"\u002F\u002F is either NULL or a pointer to struct value\n",[1903,2443,2444,2446],{"class":1905,"line":2025},[1903,2445,1959],{"class":1915},[1903,2447,2448],{"class":1919}," (val) {\n",[1903,2450,2451],{"class":1905,"line":2031},[1903,2452,2453],{"class":1909},"    \u002F\u002F Verifier knows val is non-NULL here\n",[1903,2455,2456,2459,2461,2464],{"class":1905,"line":2046},[1903,2457,2458],{"class":1919},"    val->counter",[1903,2460,2100],{"class":1915},[1903,2462,2463],{"class":1919},";",[1903,2465,2466],{"class":1909},"  \u002F\u002F Safe\n",[1903,2468,2470],{"class":1905,"line":2469},13,[1903,2471,2049],{"class":1919},[1903,2473,2475],{"class":1905,"line":2474},14,[1903,2476,2477],{"class":1909},"\u002F\u002F Verifier knows val might be NULL here\n",[1903,2479,2481,2484],{"class":1905,"line":2480},15,[1903,2482,2483],{"class":1909},"\u002F\u002F val->counter++;",[1903,2485,2486],{"class":1909},"  \u002F\u002F Would be REJECTED\n",[73,2488,2490],{"id":2489},"the-jit-compiler-from-bytecode-to-native-code","The JIT Compiler: From Bytecode to Native Code",[12,2492,2493],{},"Once verified, eBPF bytecode is compiled to native machine code by the Just-In-Time (JIT) compiler. This happens after verification, so even JIT bugs can't introduce unsafe behavior—the bytecode is already proven safe.",[12,2495,2496],{},"The JIT compiler also adds runtime protections:",[237,2498,2499,2502,2505],{},[240,2500,2501],{},"Speculative execution barriers (Spectre mitigation)",[240,2503,2504],{},"Constant blinding (JIT spraying mitigation)",[240,2506,2507],{},"Tail call limits (stack overflow prevention)",[29,2509,2511],{"id":2510},"runtime-boundaries-the-sandbox-in-action","Runtime Boundaries: The Sandbox in Action",[12,2513,2514],{},"Even after verification, eBPF programs run in a restricted environment:",[73,2516,2518],{"id":2517},"helper-functions-the-only-syscalls-you-get","Helper Functions: The Only Syscalls You Get",[12,2520,2521],{},"eBPF programs can't make arbitrary system calls. Instead, they can only call pre-approved helper functions:",[1546,2523,2525],{"className":1897,"code":2524,"language":1899,"meta":184,"style":184},"\u002F\u002F You can't do this:\nopen(\"\u002Fetc\u002Fpasswd\", O_RDONLY);  \u002F\u002F No arbitrary syscalls\n\n\u002F\u002F You can only do this:\nbpf_map_lookup_elem(&my_map, &key);  \u002F\u002F Pre-approved helper\nbpf_probe_read_user(&data, sizeof(data), user_ptr);  \u002F\u002F Another helper\n",[284,2526,2527,2532,2549,2553,2558,2581],{"__ignoreMap":184},[1903,2528,2529],{"class":1905,"line":1906},[1903,2530,2531],{"class":1909},"\u002F\u002F You can't do this:\n",[1903,2533,2534,2537,2539,2543,2546],{"class":1905,"line":185},[1903,2535,2536],{"class":1926},"open",[1903,2538,1930],{"class":1919},[1903,2540,2542],{"class":2541},"sIrxU","\"\u002Fetc\u002Fpasswd\"",[1903,2544,2545],{"class":1919},", O_RDONLY);",[1903,2547,2548],{"class":1909},"  \u002F\u002F No arbitrary syscalls\n",[1903,2550,2551],{"class":1905,"line":191},[1903,2552,2120],{"emptyLinePlaceholder":201},[1903,2554,2555],{"class":1905,"line":1956},[1903,2556,2557],{"class":1909},"\u002F\u002F You can only do this:\n",[1903,2559,2560,2563,2565,2567,2569,2571,2573,2575,2578],{"class":1905,"line":1965},[1903,2561,2562],{"class":1926},"bpf_map_lookup_elem",[1903,2564,1930],{"class":1919},[1903,2566,1933],{"class":1915},[1903,2568,1937],{"class":1936},[1903,2570,1940],{"class":1919},[1903,2572,1933],{"class":1915},[1903,2574,1945],{"class":1936},[1903,2576,2577],{"class":1919},");",[1903,2579,2580],{"class":1909},"  \u002F\u002F Pre-approved helper\n",[1903,2582,2583,2586,2588,2590,2593,2595,2598,2601],{"class":1905,"line":1971},[1903,2584,2585],{"class":1926},"bpf_probe_read_user",[1903,2587,1930],{"class":1919},[1903,2589,1933],{"class":1915},[1903,2591,2592],{"class":1936},"data",[1903,2594,1940],{"class":1919},[1903,2596,2597],{"class":1915},"sizeof",[1903,2599,2600],{"class":1919},"(data), user_ptr);",[1903,2602,2603],{"class":1909},"  \u002F\u002F Another helper\n",[12,2605,2606],{},"Each helper function is carefully implemented to be safe even if called with invalid arguments. The verifier also ensures you're calling helpers correctly based on your program type. Helper functions are whitelisted per program type. You can't call a tracing helper from an XDP program, for instance.",[73,2608,2610],{"id":2609},"maps-structured-data-sharing","Maps: Structured Data Sharing",[12,2612,2613],{},"eBPF programs communicate with userspace through maps—fixed-size data structures that both sides can access:",[1546,2615,2617],{"className":1897,"code":2616,"language":1899,"meta":184,"style":184},"\u002F\u002F Kernel side (eBPF program)\nstruct bpf_map_def SEC(\"maps\") events = {\n    .type = BPF_MAP_TYPE_RINGBUF,\n    .max_entries = 256 * 1024,\n};\n\n\u002F\u002F Safe, bounded write to ring buffer\nbpf_ringbuf_output(&events, &event, sizeof(event), 0);\n",[284,2618,2619,2624,2646,2656,2674,2679,2683,2688],{"__ignoreMap":184},[1903,2620,2621],{"class":1905,"line":1906},[1903,2622,2623],{"class":1909},"\u002F\u002F Kernel side (eBPF program)\n",[1903,2625,2626,2628,2631,2634,2636,2639,2642,2644],{"class":1905,"line":185},[1903,2627,2176],{"class":1915},[1903,2629,2630],{"class":1919}," bpf_map_def ",[1903,2632,2633],{"class":1926},"SEC",[1903,2635,1930],{"class":1919},[1903,2637,2638],{"class":2541},"\"maps\"",[1903,2640,2641],{"class":1919},") events ",[1903,2643,1923],{"class":1915},[1903,2645,2022],{"class":1919},[1903,2647,2648,2651,2653],{"class":1905,"line":191},[1903,2649,2650],{"class":1919},"    .type ",[1903,2652,1923],{"class":1915},[1903,2654,2655],{"class":1919}," BPF_MAP_TYPE_RINGBUF,\n",[1903,2657,2658,2661,2663,2666,2668,2671],{"class":1905,"line":1956},[1903,2659,2660],{"class":1919},"    .max_entries ",[1903,2662,1923],{"class":1915},[1903,2664,2665],{"class":1983}," 256",[1903,2667,1998],{"class":1915},[1903,2669,2670],{"class":1983}," 1024",[1903,2672,2673],{"class":1919},",\n",[1903,2675,2676],{"class":1905,"line":1965},[1903,2677,2678],{"class":1919},"};\n",[1903,2680,2681],{"class":1905,"line":1971},[1903,2682,2120],{"emptyLinePlaceholder":201},[1903,2684,2685],{"class":1905,"line":1990},[1903,2686,2687],{"class":1909},"\u002F\u002F Safe, bounded write to ring buffer\n",[1903,2689,2690,2693,2695,2697,2700,2702,2704,2707,2709,2711,2714,2717],{"class":1905,"line":2007},[1903,2691,2692],{"class":1926},"bpf_ringbuf_output",[1903,2694,1930],{"class":1919},[1903,2696,1933],{"class":1915},[1903,2698,2699],{"class":1936},"events",[1903,2701,1940],{"class":1919},[1903,2703,1933],{"class":1915},[1903,2705,2706],{"class":1936},"event",[1903,2708,1940],{"class":1919},[1903,2710,2597],{"class":1915},[1903,2712,2713],{"class":1919},"(event), ",[1903,2715,2716],{"class":1983},"0",[1903,2718,1948],{"class":1919},[1546,2720,2724],{"className":2721,"code":2722,"language":2723,"meta":184,"style":184},"language-go shiki shiki-themes github-dark-default github-light github-dark-default","\u002F\u002F Userspace side\nring := bpf.OpenRingBuffer(eventsMap)\nfor {\n    record, err := ring.Read()\n    \u002F\u002F Process events safely in userspace\n}\n","go",[284,2725,2726,2731,2748,2754,2770,2775],{"__ignoreMap":184},[1903,2727,2728],{"class":1905,"line":1906},[1903,2729,2730],{"class":1909},"\u002F\u002F Userspace side\n",[1903,2732,2733,2736,2739,2742,2745],{"class":1905,"line":185},[1903,2734,2735],{"class":1919},"ring ",[1903,2737,2738],{"class":1915},":=",[1903,2740,2741],{"class":1919}," bpf.",[1903,2743,2744],{"class":1926},"OpenRingBuffer",[1903,2746,2747],{"class":1919},"(eventsMap)\n",[1903,2749,2750,2752],{"class":1905,"line":191},[1903,2751,2071],{"class":1915},[1903,2753,2022],{"class":1919},[1903,2755,2756,2759,2761,2764,2767],{"class":1905,"line":1956},[1903,2757,2758],{"class":1919},"    record, err ",[1903,2760,2738],{"class":1915},[1903,2762,2763],{"class":1919}," ring.",[1903,2765,2766],{"class":1926},"Read",[1903,2768,2769],{"class":1919},"()\n",[1903,2771,2772],{"class":1905,"line":1965},[1903,2773,2774],{"class":1909},"    \u002F\u002F Process events safely in userspace\n",[1903,2776,2777],{"class":1905,"line":1971},[1903,2778,2049],{"class":1919},[12,2780,2781],{},"Maps provide:",[237,2783,2784,2787,2790],{},[240,2785,2786],{},"Bounded memory usage (size defined at creation)",[240,2788,2789],{},"Atomic operations (no data races)",[240,2791,2792],{},"Type safety (verifier ensures correct usage)",[12,2794,2795],{},"This means that map access must be bounded and deterministic, otherwise the verifier will reject the program.",[29,2797,2799],{"id":2798},"failure-modes-what-happens-when-things-go-wrong","Failure Modes: What Happens When Things Go Wrong",[12,2801,2802],{},"Let's examine specific failure scenarios and how eBPF handles them:",[73,2804,2806],{"id":2805},"scenario-1-buggy-program-logic","Scenario 1: Buggy Program Logic",[1546,2808,2810],{"className":1897,"code":2809,"language":1899,"meta":184,"style":184},"\u002F\u002F BUG: Forgot to check if ptr is NULL\nvoid *ptr = bpf_map_lookup_elem(&my_map, &key);\nint value = *(int*)ptr;  \u002F\u002F Potential NULL dereference\n",[284,2811,2812,2817,2844],{"__ignoreMap":184},[1903,2813,2814],{"class":1905,"line":1906},[1903,2815,2816],{"class":1909},"\u002F\u002F BUG: Forgot to check if ptr is NULL\n",[1903,2818,2819,2821,2823,2826,2828,2830,2832,2834,2836,2838,2840,2842],{"class":1905,"line":185},[1903,2820,2207],{"class":1915},[1903,2822,1998],{"class":1915},[1903,2824,2825],{"class":1919},"ptr ",[1903,2827,1923],{"class":1915},[1903,2829,2413],{"class":1926},[1903,2831,1930],{"class":1919},[1903,2833,1933],{"class":1915},[1903,2835,1937],{"class":1936},[1903,2837,1940],{"class":1919},[1903,2839,1933],{"class":1915},[1903,2841,1945],{"class":1936},[1903,2843,1948],{"class":1919},[1903,2845,2846,2848,2850,2852,2854,2856,2859,2862],{"class":1905,"line":191},[1903,2847,2077],{"class":1915},[1903,2849,2389],{"class":1919},[1903,2851,1923],{"class":1915},[1903,2853,1998],{"class":1915},[1903,2855,1930],{"class":1919},[1903,2857,2858],{"class":1915},"int*",[1903,2860,2861],{"class":1919},")ptr;",[1903,2863,2864],{"class":1909},"  \u002F\u002F Potential NULL dereference\n",[12,2866,2867,2870,2871,2874,2877,2878,2880,2883],{},[155,2868,2869],{},"What happens",": Verifier rejects the program at load time",[2872,2873],"br",{},[155,2875,2876],{},"System impact",": Zero—program never runs",[2872,2879],{},[155,2881,2882],{},"Error message",": \"invalid mem access 'map_value_or_null'\"",[73,2885,2887],{"id":2886},"scenario-2-resource-exhaustion-attempt","Scenario 2: Resource Exhaustion Attempt",[1546,2889,2891],{"className":1897,"code":2890,"language":1899,"meta":184,"style":184},"\u002F\u002F Attempting to consume excessive CPU\nfor (int i = 0; i \u003C 1000000; i++) {\n    expensive_operation();\n}\n",[284,2892,2893,2898,2925,2933],{"__ignoreMap":184},[1903,2894,2895],{"class":1905,"line":1906},[1903,2896,2897],{"class":1909},"\u002F\u002F Attempting to consume excessive CPU\n",[1903,2899,2900,2902,2904,2906,2908,2910,2912,2914,2916,2919,2921,2923],{"class":1905,"line":185},[1903,2901,2071],{"class":1915},[1903,2903,2074],{"class":1919},[1903,2905,2077],{"class":1915},[1903,2907,2080],{"class":1919},[1903,2909,1923],{"class":1915},[1903,2911,2085],{"class":1983},[1903,2913,2088],{"class":1919},[1903,2915,2091],{"class":1915},[1903,2917,2918],{"class":1983}," 1000000",[1903,2920,2097],{"class":1919},[1903,2922,2100],{"class":1915},[1903,2924,1987],{"class":1919},[1903,2926,2927,2930],{"class":1905,"line":191},[1903,2928,2929],{"class":1926},"    expensive_operation",[1903,2931,2932],{"class":1919},"();\n",[1903,2934,2935],{"class":1905,"line":1956},[1903,2936,2049],{"class":1919},[12,2938,2939,2941,2942,2944,2946,2947,2949,2951],{},[155,2940,2869],{},": Verifier rejects due to instruction limit",[2872,2943],{},[155,2945,2876],{},": Zero—program never loads",[2872,2948],{},[155,2950,2882],{},": \"BPF program is too large. Processed 1000001 insn\"",[73,2953,2955],{"id":2954},"scenario-3-helper-function-abuse","Scenario 3: Helper Function Abuse",[1546,2957,2959],{"className":1897,"code":2958,"language":1899,"meta":184,"style":184},"\u002F\u002F Trying to send signals to arbitrary processes\nfor (int pid = 1; pid \u003C 65536; pid++) {\n    bpf_send_signal(pid, SIGKILL);  \u002F\u002F Trying to kill everything\n}\n",[284,2960,2961,2966,2997,3008],{"__ignoreMap":184},[1903,2962,2963],{"class":1905,"line":1906},[1903,2964,2965],{"class":1909},"\u002F\u002F Trying to send signals to arbitrary processes\n",[1903,2967,2968,2970,2972,2974,2977,2979,2982,2985,2987,2990,2993,2995],{"class":1905,"line":185},[1903,2969,2071],{"class":1915},[1903,2971,2074],{"class":1919},[1903,2973,2077],{"class":1915},[1903,2975,2976],{"class":1919}," pid ",[1903,2978,1923],{"class":1915},[1903,2980,2981],{"class":1983}," 1",[1903,2983,2984],{"class":1919},"; pid ",[1903,2986,2091],{"class":1915},[1903,2988,2989],{"class":1983}," 65536",[1903,2991,2992],{"class":1919},"; pid",[1903,2994,2100],{"class":1915},[1903,2996,1987],{"class":1919},[1903,2998,2999,3002,3005],{"class":1905,"line":191},[1903,3000,3001],{"class":1926},"    bpf_send_signal",[1903,3003,3004],{"class":1919},"(pid, SIGKILL);",[1903,3006,3007],{"class":1909},"  \u002F\u002F Trying to kill everything\n",[1903,3009,3010],{"class":1905,"line":1956},[1903,3011,2049],{"class":1919},[12,3013,3014,3016],{},[155,3015,2869],{},":",[267,3018,3019,3022,3025],{},[240,3020,3021],{},"Verifier checks if program has CAP_SYS_ADMIN",[240,3023,3024],{},"Even if allowed, helper has built-in rate limiting",[240,3026,3027],{},"Operations are logged for audit",[12,3029,3030,3032],{},[155,3031,2876],{},": Limited by helper implementation safeguards",[12,3034,3035,3036,3039,3040,3043],{},"Note: Even if allowed by the verifier, helpers like ",[284,3037,3038],{},"bpf_send_signal()"," are gated by program type, capabilities (",[284,3041,3042],{},"CAP_SYS_ADMIN","), and may include runtime limits to prevent abuse.",[73,3045,3047],{"id":3046},"scenario-4-memory-corruption-attempt","Scenario 4: Memory Corruption Attempt",[1546,3049,3051],{"className":1897,"code":3050,"language":1899,"meta":184,"style":184},"\u002F\u002F Trying to write beyond buffer bounds\nchar buffer[64];\nfor (int i = 0; i \u003C 128; i++) {\n    buffer[i] = 'A';  \u002F\u002F Buffer overflow attempt\n}\n",[284,3052,3053,3058,3075,3102,3120],{"__ignoreMap":184},[1903,3054,3055],{"class":1905,"line":1906},[1903,3056,3057],{"class":1909},"\u002F\u002F Trying to write beyond buffer bounds\n",[1903,3059,3060,3063,3066,3069,3072],{"class":1905,"line":185},[1903,3061,3062],{"class":1915},"char",[1903,3064,3065],{"class":1936}," buffer",[1903,3067,3068],{"class":1919},"[",[1903,3070,3071],{"class":1983},"64",[1903,3073,3074],{"class":1919},"];\n",[1903,3076,3077,3079,3081,3083,3085,3087,3089,3091,3093,3096,3098,3100],{"class":1905,"line":191},[1903,3078,2071],{"class":1915},[1903,3080,2074],{"class":1919},[1903,3082,2077],{"class":1915},[1903,3084,2080],{"class":1919},[1903,3086,1923],{"class":1915},[1903,3088,2085],{"class":1983},[1903,3090,2088],{"class":1919},[1903,3092,2091],{"class":1915},[1903,3094,3095],{"class":1983}," 128",[1903,3097,2097],{"class":1919},[1903,3099,2100],{"class":1915},[1903,3101,1987],{"class":1919},[1903,3103,3104,3107,3110,3112,3115,3117],{"class":1905,"line":1956},[1903,3105,3106],{"class":1936},"    buffer",[1903,3108,3109],{"class":1919},"[i] ",[1903,3111,1923],{"class":1915},[1903,3113,3114],{"class":2541}," 'A'",[1903,3116,2463],{"class":1919},[1903,3118,3119],{"class":1909},"  \u002F\u002F Buffer overflow attempt\n",[1903,3121,3122],{"class":1905,"line":1965},[1903,3123,2049],{"class":1919},[12,3125,3126,3128,3129,3131,3133,3134,3136,3138],{},[155,3127,2869],{},": Verifier rejects at load time",[2872,3130],{},[155,3132,2876],{},": Zero",[2872,3135],{},[155,3137,2882],{},": \"invalid stack off=-65 size=1\"",[29,3140,3142],{"id":3141},"performance-characteristics-the-cost-of-safety","Performance Characteristics: The Cost of Safety",[12,3144,3145],{},"The verifier and runtime checks do have a cost, but it's surprisingly small:",[73,3147,3149],{"id":3148},"verification-time","Verification Time",[237,3151,3152,3155,3158],{},[240,3153,3154],{},"Simple programs: \u003C 1ms",[240,3156,3157],{},"Complex programs: 10-100ms",[240,3159,3160],{},"Happens once at load time",[73,3162,3164],{"id":3163},"runtime-overhead","Runtime Overhead",[1546,3166,3169],{"className":3167,"code":3168,"language":1551},[1549],"Native C code:        1.0x (baseline)\neBPF code:            1.1-1.2x\nKernel module:        1.0x (but no safety)\nUserspace polling:    10-100x\n",[284,3170,3168],{"__ignoreMap":184},[73,3172,3174],{"id":3173},"memory-overhead","Memory Overhead",[237,3176,3177,3180,3183],{},[240,3178,3179],{},"Program size: Limited to ~1MB of bytecode",[240,3181,3182],{},"Stack: 512 bytes per program",[240,3184,3185],{},"Maps: Explicitly bounded at creation",[29,3187,3189],{"id":3188},"the-mathematics-behind-safety","The Mathematics Behind Safety",[12,3191,3192],{},"The verifier uses abstract interpretation to prove safety properties. For each instruction, it maintains abstract state:",[1546,3194,3196],{"className":1897,"code":3195,"language":1899,"meta":184,"style":184},"State = {\n    R0: {type: SCALAR, range: [0, 100]},\n    R1: {type: PTR_TO_MAP_VALUE, offset: 0, size: 64},\n    R2: {type: PTR_TO_CTX},\n    ...\n    Stack: [{slot: -8, type: SCALAR}, ...]\n}\n",[284,3197,3198,3207,3222,3237,3242,3247,3261],{"__ignoreMap":184},[1903,3199,3200,3203,3205],{"class":1905,"line":1906},[1903,3201,3202],{"class":1919},"State ",[1903,3204,1923],{"class":1915},[1903,3206,2022],{"class":1919},[1903,3208,3209,3212,3214,3216,3219],{"class":1905,"line":185},[1903,3210,3211],{"class":1919},"    R0: {type: SCALAR, range: [",[1903,3213,2716],{"class":1983},[1903,3215,1940],{"class":1919},[1903,3217,3218],{"class":1983},"100",[1903,3220,3221],{"class":1919},"]},\n",[1903,3223,3224,3227,3229,3232,3234],{"class":1905,"line":191},[1903,3225,3226],{"class":1919},"    R1: {type: PTR_TO_MAP_VALUE, offset: ",[1903,3228,2716],{"class":1983},[1903,3230,3231],{"class":1919},", size: ",[1903,3233,3071],{"class":1983},[1903,3235,3236],{"class":1919},"},\n",[1903,3238,3239],{"class":1905,"line":1956},[1903,3240,3241],{"class":1919},"    R2: {type: PTR_TO_CTX},\n",[1903,3243,3244],{"class":1905,"line":1965},[1903,3245,3246],{"class":1919},"    ...\n",[1903,3248,3249,3252,3255,3258],{"class":1905,"line":1971},[1903,3250,3251],{"class":1919},"    Stack: [{slot: ",[1903,3253,3254],{"class":1915},"-",[1903,3256,3257],{"class":1983},"8",[1903,3259,3260],{"class":1919},", type: SCALAR}, ...]\n",[1903,3262,3263],{"class":1905,"line":1990},[1903,3264,2049],{"class":1919},[12,3266,3267],{},"For each possible path through the program, the verifier:",[267,3269,3270,3273,3276],{},[240,3271,3272],{},"Propagates abstract state forward",[240,3274,3275],{},"Checks safety at each instruction",[240,3277,3278],{},"Ensures all paths converge to safe states",[12,3280,3281],{},"This is similar to how Rust's borrow checker proves memory safety at compile time, except the eBPF verifier works on bytecode at load time.",[29,3283,3285],{"id":3284},"ebpf-in-production-real-world-applications","eBPF in Production: Real-World Applications",[179,3287],{"src":3288,"alt":3289,"style":3290},"\u002Fimages\u002F2025.Q3\u002Febpf.bee.2.jpg","eBPF Safety in Production","max-width: 400px;",[12,3292,3293],{},"This mathematical approach to safety is why major projects are betting on eBPF:",[237,3295,3296,3302,3308,3314],{},[240,3297,3298,3301],{},[155,3299,3300],{},"Cilium"," uses eBPF for container networking and security",[240,3303,3304,3307],{},[155,3305,3306],{},"Falco"," leverages eBPF for runtime security monitoring",[240,3309,3310,3313],{},[155,3311,3312],{},"systemd"," employs eBPF for system observability",[240,3315,3316,3319],{},[155,3317,3318],{},"Cloud providers"," run customer eBPF programs with confidence",[12,3321,3322,3323,3326,3327,3330],{},"At ",[731,3324,3325],{"href":1631},"Qpoint",", we use eBPF to provide deep visibility into external API traffic without compromising system stability. Our ",[731,3328,3329],{"href":1631},"Qtap"," platform leverages eBPF's safety guarantees to monitor outbound connections at the kernel level, giving teams unprecedented insight into their external dependencies.",[29,3332,3334],{"id":3333},"the-bottom-line","The Bottom Line",[12,3336,3337],{},"eBPF represents a fundamental shift in how we think about kernel extensibility. Instead of choosing between safety and performance, eBPF gives us both through static verification and runtime sandboxing. The verifier isn't just a safety check—it's a proof system that ensures your program cannot violate kernel integrity.",[12,3339,3340],{},"This is why major projects like Qpoint, Cilium, Falco, and systemd are betting on eBPF. It's why cloud providers are comfortable running customer eBPF programs. And it's why the Linux kernel community has embraced eBPF as the preferred way to extend kernel functionality.",[12,3342,3343],{},"The next time someone asks you about running code in kernel space, you can explain that eBPF programs are closer to mathematical proofs than traditional code. They're not just \"probably safe\"—they're \"prove\"-ably safe.",[16,3345],{},[12,3347,3348],{},[250,3349,3350,3351,3356,3357,3362,3363,3368],{},"Want to go deeper? Check out the ",[731,3352,3355],{"href":3353,"rel":3354},"https:\u002F\u002Fwww.kernel.org\u002Fdoc\u002Fhtml\u002Flatest\u002Fbpf\u002Fverifier.html",[735],"kernel's verifier documentation",", browse the ",[731,3358,3361],{"href":3359,"rel":3360},"https:\u002F\u002Felixir.bootlin.com\u002Flinux\u002Fv6.15\u002Fsource\u002Fkernel\u002Fbpf\u002Fverifier.c",[735],"verifier source",", or read the ✨amazing✨ ",[731,3364,3367],{"href":3365,"rel":3366},"https:\u002F\u002Fwww.linuxfoundation.org\u002Fhubfs\u002FeBPF\u002FeBPF%20Verifier%20Security%20Audit.pdf",[735],"eBPF Verifier Code Review by the NCC Group",". Hopefully, this article alongside these resources help making the decision for you to start taking advantage of the immense power of eBPF enabled programs in production!",[12,3370,3371],{},[250,3372,3373,3374,3379],{},"Inspired? Share the eBPF gospel with your kids! ",[731,3375,3378],{"href":3376,"rel":3377},"https:\u002F\u002Febpf.io\u002Fbooks\u002Fbuzzing-across-space-illustrated-childrens-guide-to-ebpf.pdf",[735],"The Illustrated Children's Guide to eBPF"," 🐝",[12,3381,3382],{},[250,3383,3384,3385,3388],{},"Ready to see eBPF in action? ",[731,3386,3387],{"href":1311},"Schedule a demo"," with a Qpoint solution engineer and discover how eBPF-powered observability can transform your understanding of external API traffic.",[3390,3391,3392],"style",{},"html pre.shiki code .soxxa, html code.shiki .soxxa{--shiki-default:#8B949E;--shiki-light:#6A737D;--shiki-dark:#8B949E}html pre.shiki code .sLAjK, html code.shiki .sLAjK{--shiki-default:#FF7B72;--shiki-light:#D73A49;--shiki-dark:#FF7B72}html pre.shiki code .s0zXF, html code.shiki .s0zXF{--shiki-default:#E6EDF3;--shiki-light:#24292E;--shiki-dark:#E6EDF3}html pre.shiki code .sZ-og, html code.shiki .sZ-og{--shiki-default:#D2A8FF;--shiki-light:#6F42C1;--shiki-dark:#D2A8FF}html pre.shiki code .sUydE, html code.shiki .sUydE{--shiki-default:#FFA657;--shiki-light:#E36209;--shiki-dark:#FFA657}html pre.shiki code .sCeZ-, html code.shiki .sCeZ-{--shiki-default:#79C0FF;--shiki-light:#005CC5;--shiki-dark:#79C0FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sIrxU, html code.shiki .sIrxU{--shiki-default:#A5D6FF;--shiki-light:#032F62;--shiki-dark:#A5D6FF}",{"title":184,"searchDepth":185,"depth":185,"links":3394},[3395,3396,3400,3404,3410,3415,3416,3417],{"id":1851,"depth":185,"text":1852},{"id":1881,"depth":185,"text":1882,"children":3397},[3398,3399],{"id":1890,"depth":191,"text":1891},{"id":2489,"depth":191,"text":2490},{"id":2510,"depth":185,"text":2511,"children":3401},[3402,3403],{"id":2517,"depth":191,"text":2518},{"id":2609,"depth":191,"text":2610},{"id":2798,"depth":185,"text":2799,"children":3405},[3406,3407,3408,3409],{"id":2805,"depth":191,"text":2806},{"id":2886,"depth":191,"text":2887},{"id":2954,"depth":191,"text":2955},{"id":3046,"depth":191,"text":3047},{"id":3141,"depth":185,"text":3142,"children":3411},[3412,3413,3414],{"id":3148,"depth":191,"text":3149},{"id":3163,"depth":191,"text":3164},{"id":3173,"depth":191,"text":3174},{"id":3188,"depth":185,"text":3189},{"id":3284,"depth":185,"text":3285},{"id":3333,"depth":185,"text":3334},"2025-09-02","Understanding how the Linux kernel can safely run user-supplied programs without risking system stability through eBPF's mathematical verification system.","\u002Fimages\u002F2025.Q3\u002Febpf.bee.1.jpg","\u002Fimages\u002F2025.Q3\u002Fbee-magnify-listing.jpg",{},"\u002Fblog\u002Febpf-safety-in-production",{"title":1840,"description":3419},"ebpf-safety-in-production","blog\u002Febpf-safety-in-production","yiuvmxP0y6j48iwDcMeR5__iNYymcsB4yl_s303OvIA",{"id":3429,"title":3430,"author":7,"body":3431,"date":3610,"description":3611,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":3612,"heroImageClasses":197,"heroShadow":202,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":3613,"logoColor":3614,"maxImgWidth":3615,"meta":3616,"navigation":201,"path":3617,"seo":3618,"slug":3619,"stem":3620,"subHeadline":197,"tags":197,"__hash__":3621},"blog\u002Fblog\u002Fheisenberg-horror-debugging.md","The Heisenberg Horror: Why Debugging Tools Make Bugs Disappear",{"type":9,"value":3432,"toc":3604},[3433,3436,3439,3442,3445,3448,3452,3455,3461,3467,3473,3476,3480,3483,3486,3500,3503,3506,3510,3513,3519,3522,3585,3588,3591,3595,3598,3601],[12,3434,3435],{},"You have a race condition in production. It crashes the payment service once every fifty requests. You pull the logs, but they're empty.",[12,3437,3438],{},"So you do the responsible thing. You add a few print statements, attach a debugger, route traffic through a proxy to inspect the payload. You redeploy and wait.",[12,3440,3441],{},"Nothing happens. The system runs perfectly.",[12,3443,3444],{},"You revert the changes and the crash returns immediately.",[12,3446,3447],{},"Welcome to the Heisenbug.",[29,3449,3451],{"id":3450},"why-your-debugging-tools-lie","Why Your Debugging Tools Lie",[12,3453,3454],{},"Traditional debugging tools are intrusive. They change the physical reality of your application's execution.",[12,3456,3457,3460],{},[155,3458,3459],{},"Adding logs:"," I\u002FO is expensive. A simple print statement introduces latency that shifts thread timing enough to resolve a race condition artificially.",[12,3462,3463,3466],{},[155,3464,3465],{},"Proxies:"," Routing traffic through a proxy adds hop latency and changes the network topology. Timeout bugs vanish.",[12,3468,3469,3472],{},[155,3470,3471],{},"Restarts:"," Most debugging requires a restart to apply changes. This wipes memory state and destroys the exact conditions that caused the bug.",[12,3474,3475],{},"These tools contaminate the experiment. To catch a Heisenbug, you need to observe without interference. You need to see the data without touching the application process, pausing the CPU, or adding I\u002FO overhead.",[29,3477,3479],{"id":3478},"the-invisible-observer","The Invisible Observer",[12,3481,3482],{},"QTap uses eBPF (Extended Berkeley Packet Filter) to insert itself into the kernel. It hooks into syscalls and libraries like OpenSSL or Go's crypto\u002Ftls outside your application's memory space.",[12,3484,3485],{},"It captures traffic, including request headers, bodies, and errors, without requiring you to:",[237,3487,3488,3491,3494,3497],{},[240,3489,3490],{},"Restart the service",[240,3492,3493],{},"Modify a single line of code",[240,3495,3496],{},"Inject a sidecar",[240,3498,3499],{},"Manage a certificate",[12,3501,3502],{},"The application process remains unaware. The timing stays authentic. The race conditions stay active. The bug stays where it is.",[12,3504,3505],{},"Stop changing your code to debug it. Just watch it work.",[29,3507,3509],{"id":3508},"actually-catching-it","Actually Catching It",[12,3511,3512],{},"With QTap running in the background, you trigger the payment flow again. Request after request scrolls by:",[1546,3514,3517],{"className":3515,"code":3516,"language":1551},[1549],"POST https:\u002F\u002Fapi.stripe.com\u002Fv1\u002Fcharges 200 OK\nPOST https:\u002F\u002Fapi.stripe.com\u002Fv1\u002Fcharges 200 OK\nPOST https:\u002F\u002Fapi.stripe.com\u002Fv1\u002Fcharges 500 Internal Server Error\n",[284,3518,3516],{"__ignoreMap":184},[12,3520,3521],{},"There it is. Request #47. You expand the payload:",[1546,3523,3527],{"className":3524,"code":3525,"language":3526,"meta":184,"style":184},"language-json shiki shiki-themes github-dark-default github-light github-dark-default","{\n  \"amount\": 5000,\n  \"currency\": \"usd\",\n  \"user_id\": null,\n  \"source\": \"tok_visa\"\n}\n","json",[284,3528,3529,3534,3547,3559,3571,3581],{"__ignoreMap":184},[1903,3530,3531],{"class":1905,"line":1906},[1903,3532,3533],{"class":1919},"{\n",[1903,3535,3536,3540,3542,3545],{"class":1905,"line":185},[1903,3537,3539],{"class":3538},"s4B-G","  \"amount\"",[1903,3541,1590],{"class":1919},[1903,3543,3544],{"class":1983},"5000",[1903,3546,2673],{"class":1919},[1903,3548,3549,3552,3554,3557],{"class":1905,"line":191},[1903,3550,3551],{"class":3538},"  \"currency\"",[1903,3553,1590],{"class":1919},[1903,3555,3556],{"class":2541},"\"usd\"",[1903,3558,2673],{"class":1919},[1903,3560,3561,3564,3566,3569],{"class":1905,"line":1956},[1903,3562,3563],{"class":3538},"  \"user_id\"",[1903,3565,1590],{"class":1919},[1903,3567,3568],{"class":1983},"null",[1903,3570,2673],{"class":1919},[1903,3572,3573,3576,3578],{"class":1905,"line":1965},[1903,3574,3575],{"class":3538},"  \"source\"",[1903,3577,1590],{"class":1919},[1903,3579,3580],{"class":2541},"\"tok_visa\"\n",[1903,3582,3583],{"class":1905,"line":1971},[1903,3584,2049],{"class":1919},[12,3586,3587],{},"The user_id is null. You check the timestamp against your session creation logs. 89 milliseconds apart. When the payment request arrives before the user session finishes writing to Redis, the ID is still null.",[12,3589,3590],{},"You never would have seen this with a debugger attached. The extra 200ms from the debugger's overhead was enough to let Redis finish every time.",[29,3592,3594],{"id":3593},"stop-chasing-ghosts","Stop Chasing Ghosts",[12,3596,3597],{},"Heisenbugs thrive in the blind spots created by intrusive tooling. They hide when you change the environment.",[12,3599,3600],{},"QTap eliminates the observer effect. The bug is still there. But now, so are you.",[3390,3602,3603],{},"html pre.shiki code .s0zXF, html code.shiki .s0zXF{--shiki-default:#E6EDF3;--shiki-light:#24292E;--shiki-dark:#E6EDF3}html pre.shiki code .s4B-G, html code.shiki .s4B-G{--shiki-default:#7EE787;--shiki-light:#005CC5;--shiki-dark:#7EE787}html pre.shiki code .sCeZ-, html code.shiki .sCeZ-{--shiki-default:#79C0FF;--shiki-light:#005CC5;--shiki-dark:#79C0FF}html pre.shiki code .sIrxU, html code.shiki .sIrxU{--shiki-default:#A5D6FF;--shiki-light:#032F62;--shiki-dark:#A5D6FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":184,"searchDepth":185,"depth":185,"links":3605},[3606,3607,3608,3609],{"id":3450,"depth":185,"text":3451},{"id":3478,"depth":185,"text":3479},{"id":3508,"depth":185,"text":3509},{"id":3593,"depth":185,"text":3594},"2025-11-25","Production bugs that vanish when you try to debug them. Learn why traditional debugging tools change what they observe and how to catch Heisenbugs with unmatched visibility.","\u002Fimages\u002F2025.Q4\u002F2025.11.25.heisenberg.png","\u002Fimages\u002F2025.Q4\u002F2025.11.25.heisenbug-listing.4.png","white",320,{},"\u002Fblog\u002Fheisenberg-horror-debugging",{"title":3430,"description":3611},"debugging-server-heisenbugs","blog\u002Fheisenberg-horror-debugging","YSxZ7Po9YyGwKoOtWHoyuvNX3p69pbsXam8PAmR1k_Y",{"id":3623,"title":3624,"author":599,"body":3625,"date":4887,"description":4888,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":4889,"heroImageClasses":4890,"heroShadow":201,"isFeatured":201,"isListed":201,"isSecondaryFeatured":202,"listingImage":4891,"logoColor":197,"maxImgWidth":197,"meta":4892,"navigation":201,"path":4893,"seo":4894,"slug":4895,"stem":4896,"subHeadline":594,"tags":197,"__hash__":4897},"blog\u002Fblog\u002Fhidden-complexities-external-deps.md","The Hidden Complexity of External Dependencies - How Qpoint Solves a Cloud-scale Problem",{"type":9,"value":3626,"toc":4872},[3627,3634,3638,3641,3655,3658,3661,3667,3670,3674,3677,3691,3700,3703,3720,3723,3727,3730,3855,3858,3878,3881,3885,3888,3914,3923,3927,3936,4002,4005,4106,4109,4276,4279,4296,4300,4303,4329,4333,4336,4587,4590,4629,4632,4646,4649,4653,4660,4669,4672,4686,4690,4693,4697,4775,4779,4831,4835,4838,4841,4844,4858,4861,4869],[12,3628,3629,3630,3633],{},"When building and operating large-scale systems, there's a critical truth we often underestimate: ",[250,3631,3632],{},"your system is only as reliable as its weakest dependency",". Let's dive into a real-world scenario where this becomes painfully evident, and how a tool like Qpoint addresses this fundamental challenge.",[29,3635,3637],{"id":3636},"the-reality-of-you-build-it-you-run-it","The Reality of \"You Build It, You Run It\"",[12,3639,3640],{},"During my time at a major cloud provider building a Platform-as-a-Service product, our team operated under what's now commonly called a DevOps or \"you build it, you run it\" model. This wasn't just a catchy phrase—it had real implications:",[237,3642,3643,3646,3649,3652],{},[240,3644,3645],{},"Development teams that built a product also owned and operated it",[240,3647,3648],{},"Engineers rotated through on-call duty, responsible for responding to incidents",[240,3650,3651],{},"We monitored resource usage, network traffic, and system health",[240,3653,3654],{},"Operations teams handled baseline monitoring, but engineers were paged in for anything notable",[12,3656,3657],{},"This approach had tremendous benefits. Our team of talented engineers brought a genuine passion for building robust, reliable systems. Operational excellence wasn't just a buzzword—it was baked into our team culture.",[12,3659,3660],{},"Let's say we have a system that looks something like this:",[12,3662,3663],{},[179,3664],{"alt":3665,"src":3666},"platform as a service system diagram","\u002Fimages\u002F2025.Q4\u002Fcsp.1.png",[12,3668,3669],{},"But here's the problem we confronted: operating a cloud platform at scale involves a complex web of dependencies, both internal and external.",[29,3671,3673],{"id":3672},"the-dependency-nightmare","The Dependency Nightmare",[12,3675,3676],{},"Let's break down what these dependencies looked like:",[267,3678,3679,3685],{},[240,3680,3681,3684],{},[155,3682,3683],{},"Internal services",": User management, billing systems, databases, etc.",[240,3686,3687,3690],{},[155,3688,3689],{},"External APIs",": Cloudflare, Github, Sentry, and numerous other third-party services",[12,3692,3693,3694,3696,3697],{},"What became painfully clear was that ",[250,3695,311],{}," of these services experienced periods of instability. Sometimes subtle, sometimes catastrophic. This created a persistent challenge: ",[155,3698,3699],{},"how do we quickly determine if the problem is in our system or in a dependency?",[12,3701,3702],{},"Our initial solution was to build extensive monitoring for these external services, but this approach came with significant downsides:",[237,3704,3705,3708,3711,3714,3717],{},[240,3706,3707],{},"It cluttered our system domain logic with monitoring code",[240,3709,3710],{},"It required building monitoring systems that operated independently of our main system",[240,3712,3713],{},"It demanded significant engineering investment",[240,3715,3716],{},"It meant more code to maintain outside of core business needs",[240,3718,3719],{},"It created more systems to operate (yes, more on-call alerts!)",[12,3721,3722],{},"This is a reminder to myself: the cost of this approach goes beyond just the initial implementation. It's the ongoing maintenance burden that really adds up.",[29,3724,3726],{"id":3725},"the-breaking-point","The Breaking Point",[12,3728,3729],{},"Let's look at how this played out in practice. Imagine a scenario where deployments suddenly started failing:",[1546,3731,3735],{"className":3732,"code":3733,"language":3734,"meta":184,"style":184},"language-javascript shiki shiki-themes github-dark-default github-light github-dark-default","func main() {\n    \u002F\u002F Customer initiates a deployment\n    deployment := InitiateDeployment(customerApp)\n\n    \u002F\u002F Fetch code from GitHub\n    sourceCode, err := github.FetchRepository(deployment.RepoURL)\n    if err != nil {\n        \u002F\u002F Is GitHub down? Is our token expired? Is our code buggy?\n        \u002F\u002F Who knows! Time to start a complex investigation...\n        log.Fatalf(\"Deployment failed: %v\", err)\n    }\n\n    \u002F\u002F Continue with deployment process...\n}\n","javascript",[284,3736,3737,3748,3753,3770,3774,3779,3800,3812,3817,3822,3838,3842,3846,3851],{"__ignoreMap":184},[1903,3738,3739,3742,3745],{"class":1905,"line":1906},[1903,3740,3741],{"class":1919},"func ",[1903,3743,3744],{"class":1926},"main",[1903,3746,3747],{"class":1919},"() {\n",[1903,3749,3750],{"class":1905,"line":185},[1903,3751,3752],{"class":1909},"    \u002F\u002F Customer initiates a deployment\n",[1903,3754,3755,3759,3762,3764,3767],{"class":1905,"line":191},[1903,3756,3758],{"class":3757},"sYc7l","    deployment",[1903,3760,3761],{"class":1919}," :",[1903,3763,1923],{"class":1915},[1903,3765,3766],{"class":1926}," InitiateDeployment",[1903,3768,3769],{"class":1919},"(customerApp)\n",[1903,3771,3772],{"class":1905,"line":1956},[1903,3773,2120],{"emptyLinePlaceholder":201},[1903,3775,3776],{"class":1905,"line":1965},[1903,3777,3778],{"class":1909},"    \u002F\u002F Fetch code from GitHub\n",[1903,3780,3781,3784,3787,3789,3791,3794,3797],{"class":1905,"line":1971},[1903,3782,3783],{"class":1919},"    sourceCode, ",[1903,3785,3786],{"class":3757},"err",[1903,3788,3761],{"class":1919},[1903,3790,1923],{"class":1915},[1903,3792,3793],{"class":1919}," github.",[1903,3795,3796],{"class":1926},"FetchRepository",[1903,3798,3799],{"class":1919},"(deployment.RepoURL)\n",[1903,3801,3802,3804,3807,3809],{"class":1905,"line":1990},[1903,3803,1974],{"class":1915},[1903,3805,3806],{"class":1919}," err ",[1903,3808,1980],{"class":1915},[1903,3810,3811],{"class":1919}," nil {\n",[1903,3813,3814],{"class":1905,"line":2007},[1903,3815,3816],{"class":1909},"        \u002F\u002F Is GitHub down? Is our token expired? Is our code buggy?\n",[1903,3818,3819],{"class":1905,"line":2013},[1903,3820,3821],{"class":1909},"        \u002F\u002F Who knows! Time to start a complex investigation...\n",[1903,3823,3824,3827,3830,3832,3835],{"class":1905,"line":2025},[1903,3825,3826],{"class":1919},"        log.",[1903,3828,3829],{"class":1926},"Fatalf",[1903,3831,1930],{"class":1919},[1903,3833,3834],{"class":2541},"\"Deployment failed: %v\"",[1903,3836,3837],{"class":1919},", err)\n",[1903,3839,3840],{"class":1905,"line":2031},[1903,3841,2010],{"class":1919},[1903,3843,3844],{"class":1905,"line":2046},[1903,3845,2120],{"emptyLinePlaceholder":201},[1903,3847,3848],{"class":1905,"line":2469},[1903,3849,3850],{"class":1909},"    \u002F\u002F Continue with deployment process...\n",[1903,3852,3853],{"class":1905,"line":2474},[1903,3854,2049],{"class":1919},[12,3856,3857],{},"When this fails, we'd start a complex investigation:",[267,3859,3860,3863,3866,3869,3872,3875],{},[240,3861,3862],{},"Check our system logs",[240,3864,3865],{},"Look for any recent code changes",[240,3867,3868],{},"Verify our GitHub credentials",[240,3870,3871],{},"Check GitHub status page",[240,3873,3874],{},"Test API access from different locations",[240,3876,3877],{},"Correlate with other GitHub-dependent systems",[12,3879,3880],{},"All of this investigation takes precious time while customers wait for their deployments to work again.",[29,3882,3884],{"id":3883},"enter-qpoint-a-better-approach","Enter Qpoint: A Better Approach",[12,3886,3887],{},"Qpoint aims to remove this entire class of problems by providing immediate visibility into external dependencies. Instead of building custom monitoring solutions, Qpoint offers:",[267,3889,3890,3896,3902,3908],{},[240,3891,3892,3895],{},[155,3893,3894],{},"Immediate detection"," when there's an issue with a third-party system",[240,3897,3898,3901],{},[155,3899,3900],{},"Contextual information"," to determine if it's a service outage on their end or an issue on yours",[240,3903,3904,3907],{},[155,3905,3906],{},"Deep insights"," into any breaking changes between services",[240,3909,3910,3913],{},[155,3911,3912],{},"Comprehensive data"," to understand the core problem",[12,3915,3916,3917,3919],{},"All without making any source code changes! Let's see how this changes our approach:",[2872,3918],{},[179,3920],{"alt":3921,"src":3922},"platform as a service system diagram with Qpoint agent interops","\u002Fimages\u002F2025.Q4\u002Fcsp.2.png",[29,3924,3926],{"id":3925},"how-qpoint-works-a-brief-technical-look","How Qpoint Works: A Brief Technical Look",[12,3928,3929,3930,3935],{},"Qpoint takes a novel approach by using ",[731,3931,3934],{"href":3932,"rel":3933},"https:\u002F\u002Febpf.io\u002F",[735],"eBPF (Extended Berkeley Packet Filter)"," technology to gain visibility directly at the source of each connection. Let's break down how this actually works:",[267,3937,3938,3955,3982],{},[240,3939,3940,3943,3944],{},[155,3941,3942],{},"Qpoint Agent Deployment",": The Qtap agent is installed directly on your application hosts. This can be deployed as:",[237,3945,3946,3949,3952],{},[240,3947,3948],{},"A Linux binary",[240,3950,3951],{},"A Docker container",[240,3953,3954],{},"A Kubernetes deployment via Helm chart",[240,3956,3957,3960,3961],{},[155,3958,3959],{},"eBPF Magic",": The agent uses eBPF to hook into the kernel and monitor network socket operations. This lets Qpoint:",[237,3962,3963,3970,3976,3979],{},[240,3964,3965,3966,3969],{},"See which ",[250,3967,3968],{},"specific processes"," are making external calls",[240,3971,3972,3973,3975],{},"Monitor traffic ",[250,3974,354],{}," encryption happens",[240,3977,3978],{},"Collect both metadata and actual payloads",[240,3980,3981],{},"Do all this with minimal overhead",[240,3983,3984,3987,3988],{},[155,3985,3986],{},"Payload Visibility",": This is where things get really interesting. Qpoint can capture the actual content of requests and responses through:",[237,3989,3990,3996],{},[240,3991,3992,3995],{},[155,3993,3994],{},"Native TLS Integration",": Works automatically with OpenSSL, GoTLS, and NodeTLS",[240,3997,3998,4001],{},[155,3999,4000],{},"Egress Controller",": For other runtimes, using a local proxy with transparent redirection",[12,4003,4004],{},"Let's see how this works with our previous GitHub example:",[1546,4006,4008],{"className":3732,"code":4007,"language":3734,"meta":184,"style":184},"\u002F\u002F Your normal application code doesn't change:\nfunc main() {\n    \u002F\u002F Customer initiates a deployment\n    deployment := InitiateDeployment(customerApp)\n\n    \u002F\u002F Fetch code from GitHub\n    sourceCode, err := github.FetchRepository(deployment.RepoURL)\n    if err != nil {\n        \u002F\u002F Log the error as usual\n        log.Fatalf(\"Deployment failed: %v\", err)\n    }\n\n    \u002F\u002F Continue with deployment process...\n}\n",[284,4009,4010,4015,4023,4027,4039,4043,4047,4063,4073,4078,4090,4094,4098,4102],{"__ignoreMap":184},[1903,4011,4012],{"class":1905,"line":1906},[1903,4013,4014],{"class":1909},"\u002F\u002F Your normal application code doesn't change:\n",[1903,4016,4017,4019,4021],{"class":1905,"line":185},[1903,4018,3741],{"class":1919},[1903,4020,3744],{"class":1926},[1903,4022,3747],{"class":1919},[1903,4024,4025],{"class":1905,"line":191},[1903,4026,3752],{"class":1909},[1903,4028,4029,4031,4033,4035,4037],{"class":1905,"line":1956},[1903,4030,3758],{"class":3757},[1903,4032,3761],{"class":1919},[1903,4034,1923],{"class":1915},[1903,4036,3766],{"class":1926},[1903,4038,3769],{"class":1919},[1903,4040,4041],{"class":1905,"line":1965},[1903,4042,2120],{"emptyLinePlaceholder":201},[1903,4044,4045],{"class":1905,"line":1971},[1903,4046,3778],{"class":1909},[1903,4048,4049,4051,4053,4055,4057,4059,4061],{"class":1905,"line":1990},[1903,4050,3783],{"class":1919},[1903,4052,3786],{"class":3757},[1903,4054,3761],{"class":1919},[1903,4056,1923],{"class":1915},[1903,4058,3793],{"class":1919},[1903,4060,3796],{"class":1926},[1903,4062,3799],{"class":1919},[1903,4064,4065,4067,4069,4071],{"class":1905,"line":2007},[1903,4066,1974],{"class":1915},[1903,4068,3806],{"class":1919},[1903,4070,1980],{"class":1915},[1903,4072,3811],{"class":1919},[1903,4074,4075],{"class":1905,"line":2013},[1903,4076,4077],{"class":1909},"        \u002F\u002F Log the error as usual\n",[1903,4079,4080,4082,4084,4086,4088],{"class":1905,"line":2025},[1903,4081,3826],{"class":1919},[1903,4083,3829],{"class":1926},[1903,4085,1930],{"class":1919},[1903,4087,3834],{"class":2541},[1903,4089,3837],{"class":1919},[1903,4091,4092],{"class":1905,"line":2031},[1903,4093,2010],{"class":1919},[1903,4095,4096],{"class":1905,"line":2046},[1903,4097,2120],{"emptyLinePlaceholder":201},[1903,4099,4100],{"class":1905,"line":2469},[1903,4101,3850],{"class":1909},[1903,4103,4104],{"class":1905,"line":2474},[1903,4105,2049],{"class":1919},[12,4107,4108],{},"Behind the scenes, Qpoint is capturing everything. When a GitHub API call fails, you'd see something like this in the Qpoint dashboard:",[1546,4110,4112],{"className":3732,"code":4111,"language":3734,"meta":184,"style":184},"Request: GET https:\u002F\u002Fapi.github.com\u002Frepos\u002Fuser\u002Frepo\u002Fcontents\nHeaders: Authorization: token gho_xxxxxxxxxxxx\n         Accept: application\u002Fvnd.github.v3+json\n\nResponse: 429 Too Many Requests\nHeaders: X-RateLimit-Limit: 5000\n         X-RateLimit-Remaining: 0\n         X-RateLimit-Reset: 1615148485\nBody: {\n  \"message\": \"API rate limit exceeded for user ID 12345.\",\n  \"documentation_url\": \"https:\u002F\u002Fdocs.github.com\u002Frest\u002Foverview\u002Fresources-in-the-rest-api#rate-limiting\"\n}\n",[284,4113,4114,4132,4145,4164,4168,4181,4205,4224,4242,4250,4262,4272],{"__ignoreMap":184},[1903,4115,4116,4119,4121,4124,4127,4129],{"class":1905,"line":1906},[1903,4117,4118],{"class":3757},"Request",[1903,4120,1590],{"class":1919},[1903,4122,4123],{"class":1983},"GET",[1903,4125,4126],{"class":3757}," https",[1903,4128,3016],{"class":1919},[1903,4130,4131],{"class":1909},"\u002F\u002Fapi.github.com\u002Frepos\u002Fuser\u002Frepo\u002Fcontents\n",[1903,4133,4134,4137,4139,4142],{"class":1905,"line":185},[1903,4135,4136],{"class":3757},"Headers",[1903,4138,1590],{"class":1919},[1903,4140,4141],{"class":3757},"Authorization",[1903,4143,4144],{"class":1919},": token gho_xxxxxxxxxxxx\n",[1903,4146,4147,4150,4153,4156,4159,4161],{"class":1905,"line":191},[1903,4148,4149],{"class":3757},"         Accept",[1903,4151,4152],{"class":1919},": application",[1903,4154,4155],{"class":1915},"\u002F",[1903,4157,4158],{"class":1919},"vnd.github.v3",[1903,4160,2282],{"class":1915},[1903,4162,4163],{"class":1919},"json\n",[1903,4165,4166],{"class":1905,"line":1956},[1903,4167,2120],{"emptyLinePlaceholder":201},[1903,4169,4170,4173,4175,4178],{"class":1905,"line":1965},[1903,4171,4172],{"class":3757},"Response",[1903,4174,1590],{"class":1919},[1903,4176,4177],{"class":1983},"429",[1903,4179,4180],{"class":1919}," Too Many Requests\n",[1903,4182,4183,4185,4187,4190,4192,4195,4197,4200,4202],{"class":1905,"line":1971},[1903,4184,4136],{"class":3757},[1903,4186,1590],{"class":1919},[1903,4188,4189],{"class":1983},"X",[1903,4191,3254],{"class":1915},[1903,4193,4194],{"class":1919},"RateLimit",[1903,4196,3254],{"class":1915},[1903,4198,4199],{"class":3757},"Limit",[1903,4201,1590],{"class":1919},[1903,4203,4204],{"class":1983},"5000\n",[1903,4206,4207,4210,4212,4214,4216,4219,4221],{"class":1905,"line":1990},[1903,4208,4209],{"class":1983},"         X",[1903,4211,3254],{"class":1915},[1903,4213,4194],{"class":1919},[1903,4215,3254],{"class":1915},[1903,4217,4218],{"class":3757},"Remaining",[1903,4220,1590],{"class":1919},[1903,4222,4223],{"class":1983},"0\n",[1903,4225,4226,4228,4230,4232,4234,4237,4239],{"class":1905,"line":2007},[1903,4227,4209],{"class":1983},[1903,4229,3254],{"class":1915},[1903,4231,4194],{"class":1919},[1903,4233,3254],{"class":1915},[1903,4235,4236],{"class":3757},"Reset",[1903,4238,1590],{"class":1919},[1903,4240,4241],{"class":1983},"1615148485\n",[1903,4243,4244,4247],{"class":1905,"line":2013},[1903,4245,4246],{"class":3757},"Body",[1903,4248,4249],{"class":1919},": {\n",[1903,4251,4252,4255,4257,4260],{"class":1905,"line":2025},[1903,4253,4254],{"class":2541},"  \"message\"",[1903,4256,1590],{"class":1919},[1903,4258,4259],{"class":2541},"\"API rate limit exceeded for user ID 12345.\"",[1903,4261,2673],{"class":1919},[1903,4263,4264,4267,4269],{"class":1905,"line":2031},[1903,4265,4266],{"class":2541},"  \"documentation_url\"",[1903,4268,1590],{"class":1919},[1903,4270,4271],{"class":2541},"\"https:\u002F\u002Fdocs.github.com\u002Frest\u002Foverview\u002Fresources-in-the-rest-api#rate-limiting\"\n",[1903,4273,4274],{"class":1905,"line":2046},[1903,4275,2049],{"class":1919},[12,4277,4278],{},"The difference? With Qpoint, we'd immediately know:",[267,4280,4281,4284,4287,4290,4293],{},[240,4282,4283],{},"The exact HTTP error code (429 Too Many Requests)",[240,4285,4286],{},"The complete error message in the response payload",[240,4288,4289],{},"The rate limit headers showing when limits will reset",[240,4291,4292],{},"Which specific process in our application made the call and on what system",[240,4294,4295],{},"Whether this is happening to all GitHub API calls or just specific endpoints",[29,4297,4299],{"id":4298},"beyond-monitoring-the-operational-advantage","Beyond Monitoring: The Operational Advantage",[12,4301,4302],{},"The power of Qpoint's approach goes beyond just identifying problems. It transforms how teams operate distributed systems in several key ways:",[267,4304,4305,4311,4317,4323],{},[240,4306,4307,4310],{},[155,4308,4309],{},"Reduced MTTR (Mean Time to Resolution)",": By immediately pinpointing the source of failures, teams can resolve issues faster",[240,4312,4313,4316],{},[155,4314,4315],{},"Elimination of \"is it us or them?\" debates",": Clear evidence means less time debating and more time fixing",[240,4318,4319,4322],{},[155,4320,4321],{},"Proactive detection",": Spot issues before they become critical failures",[240,4324,4325,4328],{},[155,4326,4327],{},"Resource optimization",": Instead of building and maintaining custom monitoring, teams can focus on core business logic",[29,4330,4332],{"id":4331},"deploying-qpoint-in-your-environment","Deploying Qpoint in Your Environment",[12,4334,4335],{},"Let's look at how you'd actually deploy Qpoint in a real environment. For a Docker-based deployment, it's as simple as:",[1546,4337,4339],{"className":3732,"code":4338,"language":3734,"meta":184,"style":184},"docker run \\\n  --user 0:0 \\\n  --privileged \\\n  --cap-add CAP_BPF \\\n  --cap-add CAP_SYS_ADMIN \\\n  --pid=host \\\n  --network=host \\\n  -v \u002Fsys:\u002Fsys \\\n  -v \u002Fvar\u002Frun\u002Fdocker.sock:\u002Fvar\u002Frun\u002Fdocker.sock \\\n  -e TINI_SUBREAPER=1 \\\n  --ulimit=memlock=-1 \\\n  us-docker.pkg.dev\u002Fqpoint-edge\u002Fpublic\u002Fqpoint:v0 \\\n  tap \\\n  --log-level=info \\\n  --registration-token=$TOKEN\n",[284,4340,4341,4346,4363,4370,4387,4401,4413,4424,4444,4480,4497,4516,4548,4553,4570],{"__ignoreMap":184},[1903,4342,4343],{"class":1905,"line":1906},[1903,4344,4345],{"class":1919},"docker run \\\n",[1903,4347,4348,4351,4354,4356,4358,4360],{"class":1905,"line":185},[1903,4349,4350],{"class":1915},"  --",[1903,4352,4353],{"class":1919},"user ",[1903,4355,2716],{"class":1983},[1903,4357,3016],{"class":1919},[1903,4359,2716],{"class":1983},[1903,4361,4362],{"class":1919}," \\\n",[1903,4364,4365,4367],{"class":1905,"line":191},[1903,4366,4350],{"class":1915},[1903,4368,4369],{"class":1919},"privileged \\\n",[1903,4371,4372,4374,4377,4379,4382,4385],{"class":1905,"line":1956},[1903,4373,4350],{"class":1915},[1903,4375,4376],{"class":1919},"cap",[1903,4378,3254],{"class":1915},[1903,4380,4381],{"class":1919},"add ",[1903,4383,4384],{"class":1983},"CAP_BPF",[1903,4386,4362],{"class":1919},[1903,4388,4389,4391,4393,4395,4397,4399],{"class":1905,"line":1965},[1903,4390,4350],{"class":1915},[1903,4392,4376],{"class":1919},[1903,4394,3254],{"class":1915},[1903,4396,4381],{"class":1919},[1903,4398,3042],{"class":1983},[1903,4400,4362],{"class":1919},[1903,4402,4403,4405,4408,4410],{"class":1905,"line":1971},[1903,4404,4350],{"class":1915},[1903,4406,4407],{"class":1919},"pid",[1903,4409,1923],{"class":1915},[1903,4411,4412],{"class":1919},"host \\\n",[1903,4414,4415,4417,4420,4422],{"class":1905,"line":1990},[1903,4416,4350],{"class":1915},[1903,4418,4419],{"class":1919},"network",[1903,4421,1923],{"class":1915},[1903,4423,4412],{"class":1919},[1903,4425,4426,4429,4432,4434,4437,4439,4441],{"class":1905,"line":2007},[1903,4427,4428],{"class":1915},"  -",[1903,4430,4431],{"class":1919},"v ",[1903,4433,4155],{"class":1915},[1903,4435,4436],{"class":3757},"sys",[1903,4438,3016],{"class":1919},[1903,4440,4155],{"class":1915},[1903,4442,4443],{"class":1919},"sys \\\n",[1903,4445,4446,4448,4450,4453,4456,4458,4460,4463,4465,4468,4470,4473,4475,4478],{"class":1905,"line":2013},[1903,4447,4428],{"class":1915},[1903,4449,4431],{"class":1919},[1903,4451,4452],{"class":1915},"\u002Fvar",[1903,4454,4455],{"class":1919},"\u002Frun\u002Fdocker.sock",[1903,4457,3016],{"class":1915},[1903,4459,4155],{"class":1919},[1903,4461,4462],{"class":3757},"var",[1903,4464,4155],{"class":1919},[1903,4466,4467],{"class":3757},"run",[1903,4469,4155],{"class":1919},[1903,4471,4472],{"class":3757},"docker",[1903,4474,221],{"class":1919},[1903,4476,4477],{"class":3757},"sock",[1903,4479,4362],{"class":1919},[1903,4481,4482,4484,4487,4490,4492,4495],{"class":1905,"line":2025},[1903,4483,4428],{"class":1915},[1903,4485,4486],{"class":1919},"e ",[1903,4488,4489],{"class":1983},"TINI_SUBREAPER",[1903,4491,1923],{"class":1915},[1903,4493,4494],{"class":1983},"1",[1903,4496,4362],{"class":1919},[1903,4498,4499,4501,4504,4506,4509,4512,4514],{"class":1905,"line":2031},[1903,4500,4350],{"class":1915},[1903,4502,4503],{"class":1919},"ulimit",[1903,4505,1923],{"class":1915},[1903,4507,4508],{"class":1919},"memlock",[1903,4510,4511],{"class":1915},"=-",[1903,4513,4494],{"class":1983},[1903,4515,4362],{"class":1919},[1903,4517,4518,4521,4523,4526,4528,4531,4533,4536,4538,4541,4543,4545],{"class":1905,"line":2046},[1903,4519,4520],{"class":1919},"  us",[1903,4522,3254],{"class":1915},[1903,4524,4525],{"class":1919},"docker.pkg.dev",[1903,4527,4155],{"class":1915},[1903,4529,4530],{"class":1919},"qpoint",[1903,4532,3254],{"class":1915},[1903,4534,4535],{"class":1919},"edge",[1903,4537,4155],{"class":1915},[1903,4539,4540],{"class":1919},"public",[1903,4542,4155],{"class":1915},[1903,4544,4530],{"class":3757},[1903,4546,4547],{"class":1919},":v0 \\\n",[1903,4549,4550],{"class":1905,"line":2469},[1903,4551,4552],{"class":1919},"  tap \\\n",[1903,4554,4555,4557,4560,4562,4565,4567],{"class":1905,"line":2474},[1903,4556,4350],{"class":1915},[1903,4558,4559],{"class":1919},"log",[1903,4561,3254],{"class":1915},[1903,4563,4564],{"class":1919},"level",[1903,4566,1923],{"class":1915},[1903,4568,4569],{"class":1919},"info \\\n",[1903,4571,4572,4574,4577,4579,4582,4584],{"class":1905,"line":2480},[1903,4573,4350],{"class":1915},[1903,4575,4576],{"class":1919},"registration",[1903,4578,3254],{"class":1915},[1903,4580,4581],{"class":1919},"token",[1903,4583,1923],{"class":1915},[1903,4585,4586],{"class":1919},"$TOKEN\n",[12,4588,4589],{},"This might look like a lot of flags, but they're necessary to give Qtap the permissions it needs to attach to kernel functions and monitor connections outside of its container. If you're a Kubernetes shop, you'd typically deploy using Helm:",[1546,4591,4593],{"className":3732,"code":4592,"language":3734,"meta":184,"style":184},"helm repo add qpoint https:\u002F\u002Fhelm.qpoint.io\nhelm install qpoint qpoint\u002Fqtap \\\n  --set registration.token=$TOKEN\n",[284,4594,4595,4608,4618],{"__ignoreMap":184},[1903,4596,4597,4600,4603,4605],{"class":1905,"line":1906},[1903,4598,4599],{"class":1919},"helm repo add qpoint ",[1903,4601,4602],{"class":3757},"https",[1903,4604,3016],{"class":1919},[1903,4606,4607],{"class":1909},"\u002F\u002Fhelm.qpoint.io\n",[1903,4609,4610,4613,4615],{"class":1905,"line":185},[1903,4611,4612],{"class":1919},"helm install qpoint qpoint",[1903,4614,4155],{"class":1915},[1903,4616,4617],{"class":1919},"qtap \\\n",[1903,4619,4620,4622,4625,4627],{"class":1905,"line":191},[1903,4621,4350],{"class":1915},[1903,4623,4624],{"class":1919},"set registration.token",[1903,4626,1923],{"class":1915},[1903,4628,4586],{"class":1919},[12,4630,4631],{},"You have two deployment options:",[267,4633,4634,4640],{},[240,4635,4636,4639],{},[155,4637,4638],{},"Cloud Connected Mode",": Managed by Qpoint's Control Plane using a registration token",[240,4641,4642,4645],{},[155,4643,4644],{},"Local Only Mode",": Self-contained deployment using a local configuration file",[12,4647,4648],{},"When building a globally distributed PaaS, having both options would have been crucial—we could start with Cloud Connected for ease of adoption, then potentially move to Local Only for sensitive environments.",[29,4650,4652],{"id":4651},"the-architecture-process-aware-visibility","The Architecture: Process-Aware Visibility",[12,4654,4655,4656,4659],{},"Let's feed two birds with one slice of bread here (as the more compassionate saying goes): we can both simplify our systems ",[250,4657,4658],{},"and"," improve reliability by adopting tools like Qpoint.",[12,4661,4662,4663,4665],{},"Here's how Qpoint's architecture works in practice:",[2872,4664],{},[179,4666],{"alt":4667,"src":4668},"Qpoint agent reporting system diagram","\u002Fimages\u002F2025.Q4\u002Fcsp.3.png",[12,4670,4671],{},"What makes Qpoint particularly powerful is its approach to visibility:",[237,4673,4674,4677,4680,4683],{},[240,4675,4676],{},"It sees actual data before encryption happens at the socket level",[240,4678,4679],{},"It identifies exactly which processes are making each external call",[240,4681,4682],{},"It maintains full service context throughout the connection lifecycle",[240,4684,4685],{},"It captures all this data without requiring certificate management or application modifications",[29,4687,4689],{"id":4688},"beyond-monitoring-real-world-examples","Beyond Monitoring: Real-World Examples",[12,4691,4692],{},"Let's look at some practical scenarios where Qpoint would have saved our team countless hours of troubleshooting:",[73,4694,4696],{"id":4695},"scenario-1-intermittent-5xx-errors-from-an-external-api","Scenario 1: Intermittent 5xx Errors from an External API",[683,4698,688,4704,688,4748],{"className":4699},[686,4700,4701,4702,4703],"flex-col","md:flex-row","gap-4","my-6",[683,4705,4712,4713,4712,4720,688],{"className":4706},[4707,814,4708,4709,4710,4711],"flex-1","border-gray-300","bg-gray-50","rounded-lg","p-6","\n    ",[1179,4714,4719],{"className":4715,"id":4718},[4716,4717,818],"font-bold","text-lg","before-qpoint","Before Qpoint",[267,4721,4726,4727,4726,4730,4726,4733,4726,4736,4726,4739,4726,4742,4726,4745,4712],{"className":4722},[4723,4724,4725],"list-decimal","list-inside","space-y-2","\n      ",[240,4728,4729],{},"Alert fires: \"High error rate on deployments\"",[240,4731,4732],{},"Check logs: \"External API returned 503\"",[240,4734,4735],{},"Is it just us? Check status page (nothing reported)",[240,4737,4738],{},"Run tests from different locations",[240,4740,4741],{},"Create support ticket with vendor",[240,4743,4744],{},"Wait hours for response...",[240,4746,4747],{},"Eventually learn they're experiencing regional outages",[683,4749,4712,4753,4712,4758,688],{"className":4750},[4707,814,4751,4752,4710,4711],"border-grape-500","bg-grape-50",[1179,4754,4757],{"className":4755,"id":4756},[4716,4717,818],"with-qpoint","With Qpoint",[267,4759,4726,4761,4726,4763,4726,4766,4726,4769,4726,4772,4712],{"className":4760},[4723,4724,4725],[240,4762,4729],{},[240,4764,4765],{},"Check Qpoint: See all 503 responses with bodies showing \"Service temporarily unavailable in us-east\"",[240,4767,4768],{},"Notice pattern: All calls to specific endpoints failing in same region",[240,4770,4771],{},"Implement immediate workaround: route traffic to different region",[240,4773,4774],{},"Notify vendor with exact error details",[73,4776,4778],{"id":4777},"scenario-2-authentication-failures","Scenario 2: Authentication Failures",[683,4780,688,4782,688,4810],{"className":4781},[686,4700,4701,4702,4703],[683,4783,4712,4785,4712,4789,688],{"className":4784},[4707,814,4708,4709,4710,4711],[1179,4786,4719],{"className":4787,"id":4788},[4716,4717,818],"before-qpoint-1",[267,4790,4726,4792,4726,4795,4726,4798,4726,4801,4726,4804,4726,4807,4712],{"className":4791},[4723,4724,4725],[240,4793,4794],{},"Customer reports: \"Can't deploy from my GitHub repo\"",[240,4796,4797],{},"Logs show: \"Authentication failed\"",[240,4799,4800],{},"Is our token expired? Check token management system",[240,4802,4803],{},"Is GitHub having auth issues? Check status page",[240,4805,4806],{},"Is our integration broken? Review recent code changes",[240,4808,4809],{},"Hours later: Discover GitHub changed their token format",[683,4811,4712,4813,4712,4817,688],{"className":4812},[4707,814,4751,4752,4710,4711],[1179,4814,4757],{"className":4815,"id":4816},[4716,4717,818],"with-qpoint-1",[267,4818,4726,4820,4726,4822,4726,4825,4726,4828,4712],{"className":4819},[4723,4724,4725],[240,4821,4794],{},[240,4823,4824],{},"Check Qpoint: See 401 responses with body showing \"Token format deprecated, please migrate to new format\"",[240,4826,4827],{},"Update token format immediately",[240,4829,4830],{},"Deploy fix within minutes",[29,4832,4834],{"id":4833},"conclusion","Conclusion",[12,4836,4837],{},"Building and operating complex distributed systems doesn't need to come with the burden of custom-built monitoring for every external dependency. Qpoint represents a fundamental shift in how we approach observability—moving beyond simple metrics and logs to provide comprehensive, contextual visibility into the entire dependency chain.",[12,4839,4840],{},"By leveraging eBPF technology to capture process-level details and actual payloads, Qpoint eliminates the guesswork and dramatically reduces troubleshooting time.",[12,4842,4843],{},"For teams operating in a \"you build it, you run it\" model, this isn't just a nice-to-have—it's a game-changer that allows engineers to:",[267,4845,4846,4849,4852,4855],{},[240,4847,4848],{},"Focus on core business logic rather than building monitoring systems",[240,4850,4851],{},"Identify root causes in minutes rather than hours",[240,4853,4854],{},"Proactively detect problems before they impact users",[240,4856,4857],{},"Make data-driven decisions about external service dependencies",[12,4859,4860],{},"The best part? All of this comes with minimal setup—a simple agent deployment—and zero changes to your application code.",[12,4862,4863,4864,4868],{},"If you want to take your API observability to the next level, I'd recommend starting a free trial of Qpoint at ",[731,4865,4866],{"href":4866,"rel":4867},"https:\u002F\u002Fqpoint.io",[735]," and seeing the difference for yourself.",[3390,4870,4871],{},"html pre.shiki code .s0zXF, html code.shiki .s0zXF{--shiki-default:#E6EDF3;--shiki-light:#24292E;--shiki-dark:#E6EDF3}html pre.shiki code .sZ-og, html code.shiki .sZ-og{--shiki-default:#D2A8FF;--shiki-light:#6F42C1;--shiki-dark:#D2A8FF}html pre.shiki code .soxxa, html code.shiki .soxxa{--shiki-default:#8B949E;--shiki-light:#6A737D;--shiki-dark:#8B949E}html pre.shiki code .sYc7l, html code.shiki .sYc7l{--shiki-default:#FFA657;--shiki-light:#6F42C1;--shiki-dark:#FFA657}html pre.shiki code .sLAjK, html code.shiki .sLAjK{--shiki-default:#FF7B72;--shiki-light:#D73A49;--shiki-dark:#FF7B72}html pre.shiki code .sIrxU, html code.shiki .sIrxU{--shiki-default:#A5D6FF;--shiki-light:#032F62;--shiki-dark:#A5D6FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sCeZ-, html code.shiki .sCeZ-{--shiki-default:#79C0FF;--shiki-light:#005CC5;--shiki-dark:#79C0FF}",{"title":184,"searchDepth":185,"depth":185,"links":4873},[4874,4875,4876,4877,4878,4879,4880,4881,4882,4886],{"id":3636,"depth":185,"text":3637},{"id":3672,"depth":185,"text":3673},{"id":3725,"depth":185,"text":3726},{"id":3883,"depth":185,"text":3884},{"id":3925,"depth":185,"text":3926},{"id":4298,"depth":185,"text":4299},{"id":4331,"depth":185,"text":4332},{"id":4651,"depth":185,"text":4652},{"id":4688,"depth":185,"text":4689,"children":4883},[4884,4885],{"id":4695,"depth":191,"text":4696},{"id":4777,"depth":191,"text":4778},{"id":4833,"depth":185,"text":4834},"2025-11-04","Your system is only as reliable as its weakest dependency. Learn how external service failures impact cloud-scale systems and how Qpoint provides immediate visibility into third-party dependencies without code changes.","\u002Fimages\u002F2025.Q4\u002Fcsp.heading.png","border-radius: 100%","\u002Fimages\u002F2025.Q4\u002Fcsp.listing.png",{},"\u002Fblog\u002Fhidden-complexities-external-deps",{"title":3624,"description":4888},"the-hidden-complexity-of-external-dependencies","blog\u002Fhidden-complexities-external-deps","ZX5tk2nnTUln6nrnuRh5L7jxdiSOVeGWM5HGhN1vWg0",{"id":4899,"title":4900,"author":599,"body":4901,"date":5076,"description":5077,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":5078,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":5079,"navigation":201,"path":5080,"seo":5081,"slug":5082,"stem":5083,"subHeadline":5077,"tags":197,"__hash__":5084},"blog\u002Fblog\u002Fhow-we-use-middleware-at-qpoint.md","How We Use Middleware",{"type":9,"value":4902,"toc":5070},[4903,4906,4910,4913,4916,4931,4934,4937,4940,4951,4955,4958,4961,4965,4968,4972,4975,4978,4982,4985,4989,4992,4996,4999,5002,5006,5029,5034,5038,5041,5044,5049,5052,5057,5062,5064,5067],[12,4904,4905],{},"At the heart of Qpoint's universal egress traffic management solution lies our powerful middleware subsystem. Designed for unparalleled flexibility, it enables platform teams and operators to inject custom functions and execute complex traffic manipulations seamlessly. Whether it's out-of-band analytics with Qtap or in-line request modifications with Qproxy, our middleware framework empowers you to tailor egress traffic handling to your unique observability, operational, and security needs.",[73,4907,4909],{"id":4908},"how-it-works","How it Works",[12,4911,4912],{},"At Qpoint we use Envoy for an integrated proxy for its ability to robustly handle large volumes of traffic with low latency. As a benefit of that we get access to Envoy’s web assembly plugin system which has been carefully architected for performance and security.",[12,4914,4915],{},"This means that extensions, or middleware functions as we call them, are launched in their own virtual machine and are segmented from the rest of the system. Resources are memory mapped into the container, removing the need to copy memory or make RPC calls between systems for data.",[12,4917,4918,4919,4924,4925,4930],{},"Middleware is implemented using ",[731,4920,4923],{"href":4921,"rel":4922},"https:\u002F\u002Fgithub.com\u002Fproxy-wasm\u002Fspec",[735],"WebAssembly for Proxies"," which implements the ",[731,4926,4929],{"href":4927,"rel":4928},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FApplication_binary_interface",[735],"Application Binary Interface (ABI)"," specification. The ABI spec supports L4 and L7 proxies, as well as other environments (for example our Qtap eBPF product). When a middleware function is loaded it is validated to ensure it conforms with the spec before being passed to a virtual machine in each of the Envoy worker threads.",[12,4932,4933],{},"One of the advantages of using the WebAssembly for Proxies interface is that we have the support of the Envoy community as well as other staples like Istio, MOSN, ATS, and OpenResty. This means that the extensions supported by these projects will work with both Qtap and Qproxy.",[12,4935,4936],{},"Another huge advantage is Web Assembly’s support for multiple languages. There are over 20 mainstream languages that compile down to WASM, any of which can implement the spec and create middleware. There are also SDKs with loads of helper functions already implemented for AssemblyScript, C++, Go (TinyGo), and Rust.",[12,4938,4939],{},"Qpoint will automatically handle loading middleware WASM modules from a number of sources:",[237,4941,4942,4945,4948],{},[240,4943,4944],{},"From a docker registry",[240,4946,4947],{},"HTTP (extension .wasm or .tar.gz)",[240,4949,4950],{},"Locally from disk",[73,4952,4954],{"id":4953},"use-cases","Use cases",[12,4956,4957],{},"Middleware takes egress traffic illumination and augmentation to the next level, going beyond traditional, relay-style management like blocking domains, IP addresses, or sources.",[12,4959,4960],{},"Here are a few of the use cases that our customers leverage middleware for today:",[1179,4962,4964],{"id":4963},"detecting-pii-data","Detecting PII Data",[12,4966,4967],{},"The dark web economy of trading leaked data is big business and Data Loss Prevention (DLP) strategies are becoming more mainstream. Qpoint offers a DLP middleware function that checks outgoing payloads for potentially sensitive data, including credit card numbers, email addresses, and social security numbers. It can also report on or (optionally) scrub this data before it leaves your network.",[1179,4969,4971],{"id":4970},"injecting-api-keys","Injecting API keys",[12,4973,4974],{},"Qpoint’s secret injection middleware allows you to actively swap known internal API keys with external (real world) API keys for protection. In addition, you can apply access control to internal keys, so a key used by service A can only make a read request to specific endpoints, while service B can read and write to all endpoints.",[12,4976,4977],{},"Third-party services typically lack access control capabilities that matches your organization security strategy (or have access control at all!). Qpoint’s middleware makes this possible by applying rules based on domain, path, and method.",[1179,4979,4981],{"id":4980},"detecting-reporting-errors","Detecting & Reporting errors",[12,4983,4984],{},"Knowing when your dependencies are down or degraded is key to keeping customers and services happy. Qpoint’s error detection middleware will surface how third-party API’s are behaving, including degradation, failures, and the sources of those issues. This eliminates the need to build monitoring tooling or to clutter your business logic with robustness checks.",[73,4986,4988],{"id":4987},"deep-dive","Deep Dive",[12,4990,4991],{},"The Qpoint middleware subsystem leverages an event-driven streaming architecture made accessible through software development kits (SDKs) and a suite of utility packages that simplify common actions.",[1179,4993,4995],{"id":4994},"streaming-api","Streaming API",[12,4997,4998],{},"A streaming API offers significant flexibility in determining middleware behavior and its impact on traffic and performance. For example, a middleware function that needs to perform out-of-band analysis on an HTTP body can capture and reassemble chunks in-flight and analyze them after the call is completed.",[12,5000,5001],{},"If a payload requires modification before reaching its destination, the HTTP call can be paused to enable the body to be modified and reassembled before allowing the request to continue.",[1179,5003,5005],{"id":5004},"streaming-flow-of-an-http-middleware-function","Streaming Flow of an HTTP Middleware Function",[267,5007,5008,5011,5014,5017,5020,5023,5026],{},[240,5009,5010],{},"HTTP Request Headers\nThe entry point of the streaming API for an HTTP request includes the payload headers. These headers can be read, modified, or removed before processing. A property of the function indicates if the stream has ended (e.g., the HTTP call has no body).",[240,5012,5013],{},"HTTP Request Body\nOnce the headers return a Continue flag, the body, if present, can be processed. This function can be called multiple times as chunks arrive. If a middleware function needs to rebuild the body for analysis, it can return a Pause flag until the stream-ending property is true. Otherwise, the Continue flag allows each chunk to pass through.",[240,5015,5016],{},"HTTP Request Trailing Headers\nTrailing headers are added after the body is processed. These headers often require the body for creation, such as adding a digest for the body. This step is similar to processing Request Headers but occurs after the Body processing call.",[240,5018,5019],{},"HTTP Response Headers\nProcessing HTTP Response headers works similarly to outgoing requests, with an end stream indicating if a body is present.",[240,5021,5022],{},"HTTP Response Body\nThe Response Body follows the same process as the Request Body but applies to the incoming body.",[240,5024,5025],{},"HTTP Response Trailing Headers\nThe Response Trailing Headers call is also similar to the Request Trailing Headers.",[240,5027,5028],{},"HTTP Done\nThe HTTP Done call is the final step in the HTTP call API. It occurs after the complete end-to-end call is finished, making it an ideal place for time-consuming operations such as logging and reporting.",[12,5030,5031],{},[179,5032],{"alt":184,"src":5033},"\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.06.06.how.we\u002Fe77f00eb-1594-43ea-a432-cfc5a9ac05f5.png",[1179,5035,5037],{"id":5036},"external-http-calls","External HTTP Calls",[12,5039,5040],{},"Qpoint provides an implementation for making external HTTP calls, routed through an internal proxy to maintain observability and control over middleware communications. These calls do not pass through the middleware stack.",[12,5042,5043],{},"Middleware functions can make remote calls during any workflow step, including in the root and plugin contexts which will be discussed in a future blog post. Pausing an HTTP request\u002Fresponse mid-flight to make remote HTTP calls can impact latency and should be used sparingly (preferably in the HTTP Done step after the request is complete).",[267,5045,5046],{},[240,5047,5048],{},"Sending HTTP calls\nQpoint offers an internal Envoy cluster for sending remote requests. A utility transaction package simplifies sending traditional Go HTTP request payloads, while core HTTP calls requiring a callback provide more control.",[12,5050,5051],{},"A callback function is required and is triggered upon receiving a response.",[267,5053,5054],{"start":185},[240,5055,5056],{},"Getting HTTP response\nWhen making remote HTTP calls, a callback function is provided. Once invoked, a similar streaming API becomes available for Response Headers, Body, and Trailing Headers.",[12,5058,5059],{},[179,5060],{"alt":184,"src":5061},"\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.06.06.how.we\u002F8fcaee5e-f345-4633-8edd-c5192402a277.png",[73,5063,4834],{"id":4833},[12,5065,5066],{},"By leveraging the robust capabilities of Envoy and the flexibility of WebAssembly, Qpoint’s middleware framework offers a powerful toolset for monitoring and managing egress traffic flows across your systems. By utilizing an event-driven, streaming architecture, our middleware subsystem can seamlessly handle complex operations such as data analysis, payload modification, and error detection - all while maintaining high performance and low latency. This ensures that your applications can adapt dynamically to various traffic conditions and security requirements without compromising on speed or efficiency.",[12,5068,5069],{},"Support for multiple programming languages and the extensive community backing of projects like Istio and OpenResty make Qpoint's middleware framework both versatile and future-proof. Whether it's injecting API keys, detecting PII, or monitoring third-party APIs, our middleware subsystem provides a comprehensive framework for improving the observability, reliability, and security of your services. As the landscape of digital interactions continues to evolve, Qpoint's middleware tech stands ready to help you navigate and excel in these changing environments.",{"title":184,"searchDepth":185,"depth":185,"links":5071},[5072,5073,5074,5075],{"id":4908,"depth":191,"text":4909},{"id":4953,"depth":191,"text":4954},{"id":4987,"depth":191,"text":4988},{"id":4833,"depth":191,"text":4834},"2024-06-06","Discover how Qpoint's versatile middleware subsystem empowers platform engineering teams with customizable traffic handling and advanced egress management capabilities.","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.06.06.how.we\u002Fhow-we-use-middleware-listing.png",{},"\u002Fblog\u002Fhow-we-use-middleware-at-qpoint",{"title":4900,"description":5077},"how-we-use-middleware-at-qpoint","blog\u002Fhow-we-use-middleware-at-qpoint","S7_qGSm_kR3TfmnmglQI8_W4oAuCkD4jSkAsTrtb7Hk",{"id":5086,"title":5087,"author":599,"body":5088,"date":5189,"description":5190,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":5191,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":5192,"navigation":201,"path":5193,"seo":5194,"slug":5195,"stem":5196,"subHeadline":5197,"tags":197,"__hash__":5198},"blog\u002Fblog\u002Fimproving-platform-reliability-with-qpoint.md","Improving Platform Reliability with Qpoint",{"type":9,"value":5089,"toc":5183},[5090,5093,5096,5100,5103,5108,5111,5115,5118,5121,5126,5129,5133,5137,5140,5151,5156,5160,5169,5171,5174,5177],[12,5091,5092],{},"I joined Qpoint to tackle the persistent challenges that platform engineering teams face building distributed applications and PaaS offerings for internal consumption, the subject of which I am intimately familiar with from roles at DigitalOcean and elsewhere. Platform teams generally use a variety of services to compose their systems. For example, a public PaaS may include mechanisms for storing files in a web-accessible manner, operating clusters, and managing domains, DNS, Docker registries, load balancers, and more. These services are not unique to a PaaS as most medium-scale systems employ many of the same services.",[12,5094,5095],{},"In most cases, these systems are composed from a combination of self-hosted and third-party services. The teams that build and operate these platforms can experience a wide variety of issues within and outside of their control. Finding the root cause of an issue is important, but knowing that it exists at all is even more critical.",[73,5097,5099],{"id":5098},"how-do-platform-teams-typically-manage-third-party-api-dependencies","How do platform teams typically manage third-party API dependencies?",[12,5101,5102],{},"Most teams employ a reactive approach, basically doing nothing until an outage in a dependency causes a cascading failure in the system. When a failure does occur, they spend time frantically trying to find the issue, eventually identifying it with bittersweet relief that the root cause is not in one of their in-house services.",[12,5104,5105],{},[179,5106],{"alt":184,"src":5107},"\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.06.20.improving.platform\u002Fba9dc940-2189-4fd7-8265-4c5e0b0d8d8b.png",[12,5109,5110],{},"This approach often results in significant downtime and disruption, as teams scramble to troubleshoot and resolve the issue. The lack of proactive monitoring and management means that recurring issues with third-party APIs are not addressed systematically, leading to a cycle of repeated failures and reactive firefighting.",[73,5112,5114],{"id":5113},"how-are-issues-and-outages-handled","How are issues and outages handled?",[12,5116,5117],{},"Over time, dependencies will have outages. A keen engineer may make a list of status pages and check those first, perhaps going a step further by subscribing to their Slack channels or RSS feeds.",[12,5119,5120],{},"Ultimately, there will be problematic dependencies that have recurring issues. This is where things start to require significant investment of time and effort. Something needs to be done, and this often starts with building monitoring and alerting right into your product - followed by adding in circuit breakers and augmenting business logic to manage flaky services.",[12,5122,5123],{},[179,5124],{"alt":184,"src":5125},"\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.06.20.improving.platform\u002F043ca2c8-9df7-46c9-8f0c-d23fa02ba33d.png",[12,5127,5128],{},"This leads to a productivity rabbit hole, especially in larger projects where product and operations teams are separate. This rabbit hole never truly goes away because the safeguards added need to be maintained, updated, and understood by product developers going forward. It introduces a permanent level of technical debt that the organization must always pay interest on.",[73,5130,5132],{"id":5131},"how-qpoint-helps","How Qpoint Helps",[1179,5134,5136],{"id":5135},"observability","Observability",[12,5138,5139],{},"Qpoint's egress observability product, Qtap, can exponentially lower the mean-time-to-resolution for issues and outages while significantly reducing technical debt. It enables platform teams to immediately answer critical questions, such as:",[237,5141,5142,5145,5148],{},[240,5143,5144],{},"What services are being used?",[240,5146,5147],{},"How much are they being used?",[240,5149,5150],{},"When failures and degradations occur, where are they happening?",[12,5152,5153],{},[179,5154],{"alt":184,"src":5155},"\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.06.20.improving.platform\u002F38175342-5b74-43ab-976d-3fd6bdab79ca.png",[1179,5157,5159],{"id":5158},"middleware","Middleware",[12,5161,5162,5163,5168],{},"Qpoint products are powered by a next generation middleware framework that allows an operator to implement fine-grained controls over egress traffic using ",[731,5164,5167],{"href":5165,"rel":5166},"https:\u002F\u002Fdocs.qpoint.io\u002Fguides\u002Fwriting-a-custom-wasm-module-in-rust",[735],"customizable WASM-based functions",". Platform teams can use the Qpoint middleware catalog to employ mitigation strategies across their services that fit the organization’s culture and outage mitigation protocol. Custom middleware functions can be written and deployed to fill in the gaps if a desired strategy is not covered by the catalog.",[73,5170,4834],{"id":4833},[12,5172,5173],{},"Addressing the complexities of modern systems requires a proactive and strategic approach. By leveraging Qpoint, organizations can significantly reduce the mean-time-to-resolution for service issues and eliminate the technical debt associated with ad hoc safeguards. This ensures a more resilient infrastructure, enabling operations teams to focus on innovation rather than firefighting. Ultimately, integrating comprehensive monitoring, alerting, and mitigation strategies centered around the egress traffic from your production applications will not only enhance system reliability but also further the organization’s long-term goals of efficiency and stability.",[12,5175,5176],{},"Are you interested in unparalleled visibility into and control over the egress traffic from your core applications to improve the reliability of your platform?",[12,5178,5179,5180,5182],{},"Explore how ",[731,5181,3325],{"href":4155}," can enable your team to enhance observability, increase operational resilience, and lock down egress traffic with a zero trust approach.",{"title":184,"searchDepth":185,"depth":185,"links":5184},[5185,5186,5187,5188],{"id":5098,"depth":191,"text":5099},{"id":5113,"depth":191,"text":5114},{"id":5131,"depth":191,"text":5132},{"id":4833,"depth":191,"text":4834},"2024-06-20","Explore how operators and SREs can improve service reliability by leveraging Qpoint's comprehensive egress observability and monitoring solution.","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.06.20.improving.platform\u002Fblog-2@3x.png",{},"\u002Fblog\u002Fimproving-platform-reliability-with-qpoint",{"title":5087,"description":5190},"improving-platform-reliability-with-qpoint","blog\u002Fimproving-platform-reliability-with-qpoint","Explore how Operators and SREs can improve service reliability by leveraging Qpoint's comprehensive egress observability and monitoring solution.","GPA42K1Y5BqXWv7WTzgUoqq93V1wiOMBFFbMrno9XSE",{"id":5200,"title":5201,"author":5202,"body":5203,"date":5551,"description":5552,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":5553,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":5554,"logoColor":3614,"maxImgWidth":197,"meta":5555,"navigation":201,"path":5556,"seo":5557,"slug":5558,"stem":5559,"subHeadline":5560,"tags":197,"__hash__":5561},"blog\u002Fblog\u002Fintroducing-devtools.md","Introducing DevTools: Chrome-style Network Tab for Your Linux Server","tyler-flint",{"type":9,"value":5204,"toc":5542},[5205,5208,5211,5215,5218,5221,5231,5237,5243,5249,5252,5256,5259,5262,5265,5272,5275,5278,5284,5288,5291,5294,5300,5306,5311,5314,5346,5350,5353,5358,5361,5366,5369,5374,5377,5380,5388,5392,5395,5398,5401,5404,5408,5411,5478,5481,5485,5499,5503,5506,5509,5512,5522,5524,5539],[12,5206,5207],{},"If you've ever spent hours debugging a production issue only to realize the problem was hiding in an API call you couldn't see, this post is for you.",[12,5209,5210],{},"Developing QTap has been one of the most exciting and rewarding projects many of us have worked on. We've spent months obsessing over eBPF performance, protocol parsing, and kernel safety. But today I want to tell you about something that started as a side quest, and turned into something we think every developer needs.",[29,5212,5214],{"id":5213},"the-debugging-problem-nobody-talks-about","The Debugging Problem Nobody Talks About",[12,5216,5217],{},"Here's the scene: You're on a production server. Something's broken. You need to see what your application is actually receiving or sending to that third-party API.",[12,5219,5220],{},"So you reach for your trusty tools:",[12,5222,5223,5226,5227,5230],{},[155,5224,5225],{},"tcpdump?"," Great, except everything is encrypted. You get hex dumps and the satisfying knowledge that ",[250,5228,5229],{},"something"," is happening.",[12,5232,5233,5236],{},[155,5234,5235],{},"Wireshark?"," Same problem. TLS is doing its job a little too well.",[12,5238,5239,5242],{},[155,5240,5241],{},"Proxy it through a MITM proxy?"," Now you've introduced latency, a bottleneck, a single point of failure, and you're managing certificates. You're also reconfiguring your application, and hoping you didn't just introduce a new bug while debugging the old one.",[12,5244,5245,5248],{},[155,5246,5247],{},"Add some logging?"," Sure, but now you need to redeploy. And you're only logging what you thought to log. The thing you need to see is probably the thing you didn't think to capture.",[12,5250,5251],{},"This is the debugging tax we've all learned to accept. The moment HTTPS enters the picture, visibility disappears. You're left guessing, adding print statements, and playing twenty questions with your own code.",[29,5253,5255],{"id":5254},"we-built-this-for-ourselves-first","We Built This for Ourselves First",[12,5257,5258],{},"As we developed QTap, we found ourselves doing excruciating amounts of testing. We needed a way to visually confirm the traffic on a single node to ensure we were capturing and attributing exactly what we claimed we were.",[12,5260,5261],{},"We tried the usual approaches. None of them gave us what we needed: a simple, browser-based view of http\u002Fs traffic in plaintext from a live server.",[12,5263,5264],{},"So we built it.",[5266,5267],"prose-point",{":images":5268,"description":5269,"layout":5270,"title":5271},"[\"\u002Fimages\u002F2025.Q4\u002Fdev-tools-connections-1.a.gif\",\"\u002Fimages\u002F2025.Q4\u002Fdev-tools-connections-1.b.gif\"]","Every network connection with process attribution. See which external services your application connects to and identify unexpected outbound connections.","[++++]","Connections",[12,5273,5274],{},"We all grew up with the Chrome Network tab. That familiar interface where you can see every request, click to expand headers and bodies, watch timing waterfall down the screen. We wanted that exact experience, but for server-side traffic.",[12,5276,5277],{},"DevTools started as an internal tool. A way to validate QTap's output. A debugging companion we could fire up during development.",[12,5279,5280,5281,221],{},"But the more we used it, the more we realized: this isn't just useful for building QTap. This is useful for building ",[250,5282,5283],{},"anything",[29,5285,5287],{"id":5286},"what-devtools-actually-does","What DevTools Actually Does",[12,5289,5290],{},"QTap DevTools gives you a browser-based interface showing all HTTP\u002FS traffic on a Linux host. In real-time. With full plaintext visibility.",[12,5292,5293],{},"No proxies. No certificates. No code changes. No restarts.",[12,5295,5296,5297,5299],{},"You install QTap, enable DevTools, and open ",[284,5298,925],{}," in your browser. Every HTTP\u002FS request and response flows through the interface as it happens: headers, bodies, timing, status codes, everything.",[12,5301,5302,5303,5305],{},"The magic is eBPF. QTap hooks into TLS libraries ",[250,5304,354],{}," encryption occurs, capturing traffic at the source. It's the same approach we use for our commercial platform, but packaged into something you can run locally in under a minute.",[179,5307],{"className":5308,"src":5310},[5309],"max-w-[500px]","\u002Fimages\u002F2025.Q4\u002Fqtap-server-detailed.svg",[12,5312,5313],{},"Some things you can do with it:",[237,5315,5316,5322,5328,5334,5340],{},[240,5317,5318,5321],{},[155,5319,5320],{},"See the actual request your app sent",", not what your logging framework decided to capture",[240,5323,5324,5327],{},[155,5325,5326],{},"Debug authentication failures"," by seeing exactly what credentials were transmitted",[240,5329,5330,5333],{},[155,5331,5332],{},"Trace container traffic"," and know exactly which container made which request",[240,5335,5336,5339],{},[155,5337,5338],{},"Copy any request as cURL"," to reproduce issues instantly",[240,5341,5342,5345],{},[155,5343,5344],{},"Watch connections in real-time"," as Server-Sent Events stream new requests as they happen",[29,5347,5349],{"id":5348},"the-aha-moments","The \"Aha\" Moments",[12,5351,5352],{},"Every time we show DevTools to a developer, there's a moment. Usually it's within the first thirty seconds.",[12,5354,5355],{},[250,5356,5357],{},"\"Wait, I can see inside HTTPS without setting up certificates?\"",[12,5359,5360],{},"Yes.",[12,5362,5363],{},[250,5364,5365],{},"\"And this works on any application? Any language?\"",[12,5367,5368],{},"If it uses a supported TLS library, yes. Node, Python, Java, Go, Ruby, all the major languages work.",[12,5370,5371],{},[250,5372,5373],{},"\"And I don't have to restart anything?\"",[12,5375,5376],{},"Nope. Just run QTap on the server and open the browser interface.",[12,5378,5379],{},"The reaction is always the same mix of relief and mild frustration. Relief that this exists, frustration that it didn't exist years ago.",[179,5381],{"alt":5382,"className":5383,"src":5387},"Sticker that says: Qpoint Loves's Open Source",[5384,5385,5386],"w-[130px]","-mb-8","-ml-1","\u002Fimages\u002F2025.Q4\u002Fqpoint-hearts-open-source.svg",[29,5389,5391],{"id":5390},"free-and-open-source","Free and Open Source",[12,5393,5394],{},"We're releasing QTap DevTools as free and open-source software under the AGPL-3.0 license.",[12,5396,5397],{},"Why? Because basic visibility into your own traffic shouldn't require an enterprise contract. If you're a developer trying to debug an API integration at 2am, you shouldn't need a budget approval to see what your code is actually sending.",[12,5399,5400],{},"We believe that open-sourcing DevTools is the right thing to do. The community deserves better debugging tools, and we want to build them alongside you.",[12,5402,5403],{},"QTap Pro is available under a commercial license if you need additional features or different licensing terms, but the core DevTools functionality is free for everyone.",[29,5405,5407],{"id":5406},"getting-started","Getting Started",[12,5409,5410],{},"Installation takes about 60 seconds:",[1546,5412,5416],{"className":5413,"code":5414,"language":5415,"meta":184,"style":184},"language-bash shiki shiki-themes github-dark-default github-light github-dark-default","# Install\ncurl -s https:\u002F\u002Fget.qpoint.io\u002Finstall | sudo sh\n\n# Run\nsudo qtap --enable-dev-tools\n\n# Connect\nopen http:\u002F\u002Flocalhost:10001\n","bash",[284,5417,5418,5423,5442,5446,5451,5462,5466,5471],{"__ignoreMap":184},[1903,5419,5420],{"class":1905,"line":1906},[1903,5421,5422],{"class":1909},"# Install\n",[1903,5424,5425,5427,5430,5433,5436,5439],{"class":1905,"line":185},[1903,5426,286],{"class":3757},[1903,5428,5429],{"class":1983}," -s",[1903,5431,5432],{"class":2541}," https:\u002F\u002Fget.qpoint.io\u002Finstall",[1903,5434,5435],{"class":1915}," |",[1903,5437,5438],{"class":3757}," sudo",[1903,5440,5441],{"class":2541}," sh\n",[1903,5443,5444],{"class":1905,"line":191},[1903,5445,2120],{"emptyLinePlaceholder":201},[1903,5447,5448],{"class":1905,"line":1956},[1903,5449,5450],{"class":1909},"# Run\n",[1903,5452,5453,5456,5459],{"class":1905,"line":1965},[1903,5454,5455],{"class":3757},"sudo",[1903,5457,5458],{"class":2541}," qtap",[1903,5460,5461],{"class":1983}," --enable-dev-tools\n",[1903,5463,5464],{"class":1905,"line":1971},[1903,5465,2120],{"emptyLinePlaceholder":201},[1903,5467,5468],{"class":1905,"line":1990},[1903,5469,5470],{"class":1909},"# Connect\n",[1903,5472,5473,5475],{"class":1905,"line":2007},[1903,5474,2536],{"class":3757},[1903,5476,5477],{"class":2541}," http:\u002F\u002Flocalhost:10001\n",[12,5479,5480],{},"That's it. Open your browser and you're watching traffic.",[5482,5483],"dev-tools-demo-video",{"hide-open-source":5484},"true",[12,5486,5487,5488,5493,5494,221],{},"For more details, check out the ",[731,5489,5492],{"href":5490,"rel":5491},"https:\u002F\u002Fdocs.qpoint.io\u002Fguides\u002Fdevtools-guides\u002Fgetting-started-with-devtools",[735],"full documentation"," or explore the code on ",[731,5495,5498],{"href":5496,"rel":5497},"https:\u002F\u002Fgithub.com\u002Fqpoint-io\u002Fqtap",[735],"GitHub",[29,5500,5502],{"id":5501},"whats-next","What's Next",[12,5504,5505],{},"This is the beginning of what we hope will be a valuable tool for developers everywhere. We're actively working on expanding protocol support like PostgreSQL, MySQL, Redis, Kafka, DNS, and more.",[12,5507,5508],{},"We'd love your feedback. Open an issue, submit a PR, or just let us know what you'd like to see. We built this for ourselves first, but now we're building it for all of us.",[12,5510,5511],{},"Happy debugging,",[12,5513,5514,5517,5519],{},[155,5515,5516],{},"Tyler Flint",[2872,5518],{},[250,5520,5521],{},"Co-founder & CEO, Qpoint",[16,5523],{},[12,5525,5526],{},[250,5527,5528,5529,5533,5534,5538],{},"Ready to try it? ",[731,5530,5532],{"href":5496,"rel":5531},[735],"View QTap on GitHub"," or check out the ",[731,5535,5537],{"href":5536},"\u002Fproducts\u002Fdevtools","DevTools product page"," for more details.",[3390,5540,5541],{},"html pre.shiki code .soxxa, html code.shiki .soxxa{--shiki-default:#8B949E;--shiki-light:#6A737D;--shiki-dark:#8B949E}html pre.shiki code .sYc7l, html code.shiki .sYc7l{--shiki-default:#FFA657;--shiki-light:#6F42C1;--shiki-dark:#FFA657}html pre.shiki code .sCeZ-, html code.shiki .sCeZ-{--shiki-default:#79C0FF;--shiki-light:#005CC5;--shiki-dark:#79C0FF}html pre.shiki code .sIrxU, html code.shiki .sIrxU{--shiki-default:#A5D6FF;--shiki-light:#032F62;--shiki-dark:#A5D6FF}html pre.shiki code .sLAjK, html code.shiki .sLAjK{--shiki-default:#FF7B72;--shiki-light:#D73A49;--shiki-dark:#FF7B72}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":184,"searchDepth":185,"depth":185,"links":5543},[5544,5545,5546,5547,5548,5549,5550],{"id":5213,"depth":185,"text":5214},{"id":5254,"depth":185,"text":5255},{"id":5286,"depth":185,"text":5287},{"id":5348,"depth":185,"text":5349},{"id":5390,"depth":185,"text":5391},{"id":5406,"depth":185,"text":5407},{"id":5501,"depth":185,"text":5502},"2025-12-04","We built a browser-based debugging tool that shows live http\u002Fs traffic on production servers. No proxies, no certificates, no code changes. Just the visibility we always wished we had.","\u002Fimages\u002F2025.Q4\u002Fqpont-dev-tools.1.png","\u002Fimages\u002F2025.Q4\u002Fdev-tools-listing-3.gif",{},"\u002Fblog\u002Fintroducing-devtools",{"title":5201,"description":5552},"introducing-devtools","blog\u002Fintroducing-devtools","We scratched our own itch and built the debugging tool we always wished existed. Now we're sharing it with you.","OPcr9yo0CC9Tj5EGxN0cRDqavYhiOv6iYrBAs9MSWJs",{"id":5563,"title":5564,"author":5565,"body":5566,"date":5829,"description":5830,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":5831,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":5832,"navigation":201,"path":5833,"seo":5834,"slug":5835,"stem":5836,"subHeadline":5830,"tags":197,"__hash__":5837},"blog\u002Fblog\u002Flessons-in-reliability-rishi-goomars-journey-from-dev-to-sre.md","Lessons in Reliability: Rishi Goomar's Journey from Dev to SRE","rob-genova",{"type":9,"value":5567,"toc":5822},[5568,5571,5576,5580,5594,5600,5606,5609,5612,5615,5620,5626,5630,5637,5642,5647,5652,5657,5662,5667,5672,5677,5682,5687,5692,5697,5702,5707,5711,5724,5729,5734,5737,5742,5747,5752,5755,5760,5765,5770,5775,5780,5785,5790,5795,5799,5812,5816],[12,5569,5570],{},"Rishi Goomar is a Chicago-based Staff Site Reliability Engineer at Lattice and an advisor at QPoint. With a background in front-end and full-stack development, Rishi has evolved into a leader in continuous integration, site reliability, and cloud infrastructure. He is passionate about exploring new technologies and fostering growth in both technical skills and leadership.",[12,5572,5573],{},[250,5574,5575],{},"Part of our Ops Heroes series, this interview dives into Rishi’s journey from a curious tinkerer to a seasoned SRE, exploring the insights and experiences that have shaped his career.",[73,5577,5579],{"id":5578},"from-tinkering-to-tech","From Tinkering to Tech",[12,5581,5582],{},[250,5583,5584],{},[155,5585,5586,5587,5586],{},"\"",[250,5588,5589],{},[155,5590,5591],{},[155,5592,5593],{},"That's one of the hills that I'll die on. Jenkins is not good!",[12,5595,5596,5599],{},[155,5597,5598],{},"Qpoint:"," Rishi, you’ve had a fascinating journey from front-end development to becoming a Staff SRE. What sparked your interest in the tech field, and how did that passion evolve into a focus on operations and SRE work?",[12,5601,5602,5605],{},[155,5603,5604],{},"Rishi Goomar:"," What sparked my interest initially was tinkering around in high school. I built my own computer. I dug into one of the first Raspberry Pis. I also got into trying to figure out ways to make money without leaving home which led me to learn some basic skills like HTML, CSS, JavaScript, and so on. This was probably 16 years ago!",[12,5607,5608],{},"My first jobs were front end focused with some backend, but I've always had an interest in Linux. I probably bricked two or three laptops, just trying to mess around with complicated distributions like Gentoo, where you have to compile everything and configure a bunch of flags.",[12,5610,5611],{},"So when it came time to deploy, some of that Linux tinkering came in handy. And I was like.. oh, I could write a bash script to do this! There were no complicated containers. It was basically  FTP this up and use a script to initialize it. There were definitely issues though. You get situations where you have to troubleshoot and rollbacks were not easy.",[12,5613,5614],{},"One of the issues that really got me into the DevOps\u002FSRE side of things was that we had no automated testing at my first startup. And we were growing fast - there were well over a hundred engineers. Myself and another engineer started a team just to get automated testing in place and get a CI pipeline going. That's how I started my first foray into SRE and infrastructure automation.",[12,5616,5617,5619],{},[155,5618,5598],{}," Where was your tech hosted?",[12,5621,5622,5625],{},[155,5623,5624],{},"Rishi:"," This was on AWS but we used a slew of tools like Chef and Jenkins which I had to manage. And, I'm gonna be honest, Jenkins is not the easiest thing to manage because it doesn't use a good stateful system. That's one of the hills that I'll die on. Jenkins is not good!",[73,5627,5629],{"id":5628},"fighting-fires-and-learning-on-the-job","Fighting Fires and Learning on the Job",[12,5631,5632],{},[250,5633,5586,5634],{},[155,5635,5636],{},"We had so much load that it caused our database to essentially topple over.\"",[12,5638,5639,5641],{},[155,5640,3325],{},": Which startup was it that really got you into SRE?",[12,5643,5644,5646],{},[155,5645,5624],{}," Uptake was where I got my start in the ops space. And then after being on that team for a while, I joined Rocket Travel and that's where I became an infrastructure SRE full time. That was where I got the most exposure because it was me and one other person. And there were many fires to put out. Like .. this was a startup that is growing quite a bit and recently got acquired, and has a path forward towards more positive EBITDA and things like that, so there's a lot being done.",[12,5648,5649,5651],{},[155,5650,5598],{}," What was the craziest outage you had to deal with?",[12,5653,5654,5656],{},[155,5655,5624],{}," There was a crazy one at Lattice where we got a huge amount of traffic due to one of our larger customers initiating a massive review cycle at the time. This caused a lot of strain on our systems. Some of the queries were not optimized and the code paths were not there. We had so much load that it caused our database to essentially topple over. We put the site in maintenance mode, but when we brought the system back up we ran into a thundering herd problem that brought it right back down again. Our workaround was essentially to throw money at the problem and beef everything up temporarily while we figured out a fix to the root cause. Easy to do with cloud!",[12,5658,5659,5661],{},[155,5660,5598],{}," You are still at Lattice today ..",[12,5663,5664,5666],{},[155,5665,5624],{}," Yeah, so Lattice is basically an all-in-one HR tool at this point. It started out with talent management like performance reviews, 1:1’s, HRIS, Payroll (soon) and goal setting. We are currently moving towards an all-in-one people platform.",[12,5668,5669,5671],{},[155,5670,5598],{}," What is your most valuable operations tool?",[12,5673,5674,5676],{},[155,5675,5624],{}," One of my favorite tools has been DataDog. You can integrate everything, use database management to see the queries, and do stack traces. I have found it to be a very powerful tool. For most companies, I feel like you should focus on making sure the reliability is there. You need the observability.",[12,5678,5679,5681],{},[155,5680,5598],{}," Have you had to deal with any security breaches?",[12,5683,5684,5686],{},[155,5685,5624],{}," Not any particularly heinous ones. More like vulnerabilities that we discovered through logging or we just noticed something very strange. I’ve found that a lot of those security incidents tend to highlight principles that you can apply elsewhere though.",[12,5688,5689,5691],{},[155,5690,5598],{}," Which principles have you found to be particularly important?",[12,5693,5694,5696],{},[155,5695,5624],{}," Definitely least privilege. And regular pen testing. Using a service like HackerOne on your site is incredibly helpful because not everyone knows how to test through those use cases.",[12,5698,5699,5701],{},[155,5700,5598],{}," Any other ops hills that you would die on other than Jenkins?",[12,5703,5704,5706],{},[155,5705,5624],{}," You don't need Kubernetes for everything. I’ve seen plenty of startups try to start off by building clusters and getting complicated with their systems. There is so much complexity with a Kubernetes cluster, especially as you scale up and need to manage multiple clusters. There are many open source alternatives like Dokku and Kamal or even paid services like Render or ECS  Fargate that abstract a lot of the complexity.",[73,5708,5710],{"id":5709},"sre-principles-that-matter-most","SRE Principles That Matter Most",[12,5712,5713],{},[250,5714,5715],{},[155,5716,5586,5717,5586],{},[250,5718,5719],{},[155,5720,5721],{},[155,5722,5723],{},"When you're at a company that's growing rapidly, just embrace the failure and learn from it.",[12,5725,5726,5728],{},[155,5727,5598],{}," When something goes wrong, how does that tend to play out on your team?",[12,5730,5731,5733],{},[155,5732,5624],{}," The one thing I think we've done pretty well with is attribution of issues. We've figured out how to route the different types of errors to the correct teams or services. For the most part, the right people get looped into an incident. When things do go wrong, the important thing is to learn from it and make sure that we're having a conversation about what happened, what we can do better, and not necessarily point the finger. What I've seen happen a lot is that a person will take the accountability for it themselves and be like, \"Oh, I'm sorry I caused that\".",[12,5735,5736],{},"And honestly, I see that as a rite of passage. When you're at a company that's growing rapidly, just embrace the failure and learn from it.",[12,5738,5739,5741],{},[155,5740,5598],{}," Any thoughts on the state of SRE today or how you think it should evolve?",[12,5743,5744,5746],{},[155,5745,5624],{}," I'm seeing an increased focus on data stores, which has been really good to see. It makes sense with the AI boom that's happening right now. I've dug pretty deep into Postgres over the last few years. I think there's a lot of power in these database tools that is currently underutilized. We were able to get rid of two whole read replicas just by optimizing queries without sacrificing performance.",[12,5748,5749,5751],{},[155,5750,5598],{}," Will AI be a game changer for SRE?",[12,5753,5754],{},"I think it will change things for the better, but we're not there yet. There are a lot of things that end up being manual work or toil on the operations side, and I think there's an opportunity to use AI to help reduce that. I think it's going to be a while before AI can recommend the right infrastructure or architecture based on the use cases and how to make it highly available and integrate with other systems. But I see it being very useful as an assistant. I leverage Copilot or Anthropic like a compass in a way. It writes pretty good Bash. For complex queries though, it can give suggestions but not necessarily the right answers. There is a lot more on the line (for ops) than just having it write an application for you. Since it is like the infrastructure upon which all of the applications for your company run - if something goes wrong it's going to impact the whole business.",[12,5756,5757,5759],{},[155,5758,5598],{}," Looks like you are living in Chicago. Did you grow up there?",[12,5761,5762,5764],{},[155,5763,5624],{}," Yeah, I grew up in the suburbs here and have been living in the city for 13 years now.",[12,5766,5767,5769],{},[155,5768,5598],{}," I noticed on your website that you're a foodie. Do you watch The Bear?",[12,5771,5772,5774],{},[155,5773,5624],{}," Yep. I’m a bit of a foodie. I think regardless of being a foodie, everyone in Chicago is into The Bear! Partly because the place on the show is a real restaurant, Mr. Beef.",[12,5776,5777,5779],{},[155,5778,5598],{}," Have you been there?",[12,5781,5782,5784],{},[155,5783,5624],{}," Yeah, it's pretty good!  I'm more of a basic or a lazy cook at home, but when I go out I love to try whatever the restaurant specializes in - especially the weird stuff!",[12,5786,5787,5789],{},[155,5788,5598],{}," Thanks so much for your time today, Rishi.",[12,5791,5792,5794],{},[155,5793,5624],{}," Thanks, Rob. Take care.",[73,5796,5798],{"id":5797},"connect-with-rishi","Connect with Rishi",[12,5800,5801,5802,297,5807,5811],{},"Check out Rishi on ",[731,5803,5806],{"href":5804,"rel":5805},"https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Frgoomar\u002F",[735],"LinkedIn",[731,5808,5498],{"href":5809,"rel":5810},"https:\u002F\u002Fgithub.com\u002Frgoomar",[735]," to dive deeper into his world of SRE and tech innovation.",[73,5813,5815],{"id":5814},"take-control-of-your-external-integrations-with-qpoint","Take Control of Your External Integrations with Qpoint",[12,5817,5818,5819,5821],{},"Are your highly connected applications and their external dependencies causing operational headaches? ",[731,5820,3387],{"href":1311}," with one of our solution engineers to discover how Qpoint can help make your modern applications more resilient, secure, and cost-effective.",{"title":184,"searchDepth":185,"depth":185,"links":5823},[5824,5825,5826,5827,5828],{"id":5578,"depth":191,"text":5579},{"id":5628,"depth":191,"text":5629},{"id":5709,"depth":191,"text":5710},{"id":5797,"depth":191,"text":5798},{"id":5814,"depth":191,"text":5815},"2024-09-11","Insights from a Staff SRE at Lattice on Building Resilient Systems","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.09.11\u002Fops-heroes-rishi-goomar.png",{},"\u002Fblog\u002Flessons-in-reliability-rishi-goomars-journey-from-dev-to-sre",{"title":5564,"description":5830},"lessons-in-reliability-rishi-goomars-journey-from-dev-to-sre","blog\u002Flessons-in-reliability-rishi-goomars-journey-from-dev-to-sre","hbqpozhHCj1o9xMpu_yK4XGZ8oAwkYlFuASNpBR1zb0",{"id":5839,"title":5840,"author":7,"body":5841,"date":6118,"description":6119,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":197,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":6120,"navigation":201,"path":6121,"seo":6122,"slug":6123,"stem":6124,"subHeadline":197,"tags":197,"__hash__":6125},"blog\u002Fblog\u002Fma-due-diligence-black-box.md","The M&A Due Diligence Black Box: Why Technical DD Takes Weeks (And How to Get It Done in Days)",{"type":9,"value":5842,"toc":6108},[5843,5846,5849,5853,5856,5859,5862,5865,5868,5872,5875,5878,5881,5884,5888,5891,5894,5897,5900,5917,5920,5924,5927,5933,5939,5945,5951,5954,5960,5966,5972,5976,5979,5982,6008,6011,6014,6018,6021,6024,6027,6030,6034,6037,6040,6054,6057,6061,6064,6067,6070,6073,6075,6080,6100,6105],[12,5844,5845],{},"Every CISO that's ever gone through an acquisition knows the technical due diligence black hole. The weeks spent answering endless questions about third-party dependencies. The scramble to document what your systems actually do versus what everyone thinks they do. The uncomfortable reality that you're giving the acquiring company an incomplete picture because the documentation is always outdated and some integrations were never documented in the first place.",[12,5847,5848],{},"In every acquisition, the acquiring company needs answers to fundamental questions: What external services does this product depend on? What APIs does it call? What data flows where? These questions sound simple, but answering them is anything but.",[29,5850,5852],{"id":5851},"the-weeks-long-scramble","The Weeks-Long Scramble",[12,5854,5855],{},"Picture the typical scenario. An acquiring company's technical due diligence team sends over their questionnaire. One question stands out: \"Please provide a complete inventory of all third-party services, APIs, and external dependencies used by your platform.\"",[12,5857,5858],{},"What follows is predictable chaos:",[12,5860,5861],{},"The target company scrambles. Engineering teams dig through code repositories. Platform teams export cloud billing reports. Security reviews old vendor contracts. Developers try to recall which services they integrated months ago. Everyone hopes they're not missing anything critical.",[12,5863,5864],{},"Weeks pass. Spreadsheets grow. But the acquiring company knows the uncomfortable truth: they're getting an incomplete picture. Documentation is outdated. Some integrations were never documented. Developers have left. Test environments differ from production. The reality of what the system actually does versus what everyone thinks it does are two different things.",[12,5866,5867],{},"For the acquiring company, this creates risk. They're about to write a check, and they don't fully understand what they're buying. Hidden dependencies mean hidden costs. Undocumented APIs mean integration surprises. Unknown data flows mean compliance headaches.",[29,5869,5871],{"id":5870},"the-real-problem-runtime-reality-vs-documentation","The Real Problem: Runtime Reality vs Documentation",[12,5873,5874],{},"Here's why this process takes so long: you're trying to reconstruct reality from artifacts. You're looking at code, configuration files, infrastructure-as-code templates, cloud billing, and vendor invoices. You're asking people what they remember. You're hoping documentation is current.",[12,5876,5877],{},"But the only source of truth is what's actually happening at runtime. What connections is your application making right now? What APIs is it calling? What data is moving where?",[12,5879,5880],{},"Traditional monitoring tools can't help much here. Web application firewalls see encrypted traffic fly by but can't tell you what's inside. Cloud security posture management tools show you infrastructure configuration, not runtime behavior. Application performance monitoring focuses on performance metrics, not comprehensive dependency mapping.",[12,5882,5883],{},"The gap between what you think your system does and what it actually does can be massive. Especially in modern distributed systems with microservices, containers, and dozens of third-party integrations.",[29,5885,5887],{"id":5886},"a-different-approach-see-whats-actually-happening","A Different Approach: See What's Actually Happening",[12,5889,5890],{},"This is where visibility changes everything. Instead of reconstructing reality from documentation, you observe it directly.",[12,5892,5893],{},"Qpoint's Qtap agent uses eBPF to capture network activity at the kernel level, where all connections originate. When you deploy Qtap in a target company's development or staging environment, something remarkable happens: within minutes, you have a complete, accurate inventory of every external connection the system makes.",[12,5895,5896],{},"Not what developers think it makes. Not what documentation says. What it actually makes.",[12,5898,5899],{},"Because Qtap operates at the kernel level, it sees traffic before TLS encryption happens. This means you get full visibility into:",[237,5901,5902,5905,5908,5911,5914],{},[240,5903,5904],{},"Every API endpoint called",[240,5906,5907],{},"Every third-party service contacted",[240,5909,5910],{},"The actual payloads being sent and received",[240,5912,5913],{},"Which specific processes and containers make each connection",[240,5915,5916],{},"Request\u002Fresponse details including headers and status codes",[12,5918,5919],{},"All of this with zero code changes, no proxy infrastructure, and no certificate management. You run a lightweight agent and observe.",[29,5921,5923],{"id":5922},"the-ma-value-proposition","The M&A Value Proposition",[12,5925,5926],{},"For acquiring companies, this capability transforms technical due diligence:",[12,5928,5929,5932],{},[155,5930,5931],{},"Complete dependency discovery in days, not weeks."," Deploy Qtap in the target's non-production environment, let it observe normal operations, and generate a comprehensive report. You now have the definitive answer to \"what does this system depend on?\" For larger infrastructures with multiple environments or microservices spread across hundreds of hosts, Qplane provides a centralized dashboard that aggregates and visualizes inventory across your entire fleet of agents. Instead of piecing together data from individual servers, you see the complete dependency graph in one place.",[12,5934,5935,5938],{},[155,5936,5937],{},"Validation of claims."," The target company says they only use AWS services? Qtap will show you if that's true. They claim no AI service usage? You'll see every OpenAI, Anthropic, or Cohere API call. They assert data never leaves certain boundaries? The connection logs prove it one way or another.",[12,5940,5941,5944],{},[155,5942,5943],{},"Baseline security posture."," Beyond just listing dependencies, you see what data is flowing where. Qtap's classification capabilities can flag sensitive data patterns (PII, credentials, API keys) in motion. This gives you immediate insight into the target's security hygiene and potential compliance risks.",[12,5946,5947,5950],{},[155,5948,5949],{},"Cost and usage intelligence."," See which services are heavily used versus barely touched. Identify redundant subscriptions or overlapping tools. Understand the real operational footprint, not just the contracted one.",[12,5952,5953],{},"For target companies, the value is equally compelling:",[12,5955,5956,5959],{},[155,5957,5958],{},"Avoid weeks of manual work."," Instead of pulling together fragmented information, you run Qtap and hand over a comprehensive report. Your engineering team stays focused on running the business instead of answering endless questionnaires.",[12,5961,5962,5965],{},[155,5963,5964],{},"Provide credible evidence."," You're not giving them a spreadsheet someone compiled from memory. You're providing observed, timestamped connection data from Qplane's dashboard showing the complete inventory across your infrastructure. It's unimpeachable.",[12,5967,5968,5971],{},[155,5969,5970],{},"Demonstrate operational maturity."," Being able to produce this level of visibility quickly signals technical sophistication. It shows you understand your own systems.",[29,5973,5975],{"id":5974},"the-installation-reality","The Installation Reality",[12,5977,5978],{},"The key enabler here is deployment simplicity. Traditional enterprise security tools require extensive architecture changes. Service meshes need sidecars everywhere. Proxies need traffic rerouted. These approaches are non-starters for the temporary, time-sensitive nature of M&A due diligence.",[12,5980,5981],{},"Qtap works differently. Installation is typically:",[1546,5983,5985],{"className":5413,"code":5984,"language":5415,"meta":184,"style":184},"curl -s https:\u002F\u002Fget.qpoint.io\u002Finstall | sudo sh\nsudo qtap\n",[284,5986,5987,6001],{"__ignoreMap":184},[1903,5988,5989,5991,5993,5995,5997,5999],{"class":1905,"line":1906},[1903,5990,286],{"class":3757},[1903,5992,5429],{"class":1983},[1903,5994,5432],{"class":2541},[1903,5996,5435],{"class":1915},[1903,5998,5438],{"class":3757},[1903,6000,5441],{"class":2541},[1903,6002,6003,6005],{"class":1905,"line":185},[1903,6004,5455],{"class":3757},[1903,6006,6007],{"class":2541}," qtap\n",[12,6009,6010],{},"That's it. The eBPF agent attaches to kernel functions and starts observing. No architecture changes. No application restarts. No proxy configuration. For a Kubernetes environment, it's a helm chart that takes minutes to deploy.",[12,6012,6013],{},"This lightweight approach makes it practical to spin up visibility for the due diligence period, gather the data needed, and make informed decisions. If the acquisition proceeds, you already have the foundation for ongoing observability. If it doesn't, you've spent days instead of weeks learning what you needed to know.",[29,6015,6017],{"id":6016},"beyond-due-diligence-the-corporate-development-play","Beyond Due Diligence: The Corporate Development Play",[12,6019,6020],{},"The smartest acquiring companies are thinking beyond one-off due diligence. Organizations like Cisco, which make multiple acquisitions per year, are building this capability into their standard corporate development process.",[12,6022,6023],{},"The pattern is compelling: give your corporate development team access to Qtap. When they're evaluating a target, they deploy it as part of technical validation. This gives them immediate visibility and builds relationships with both the target's security team and the acquiring company's engineering organization.",[12,6025,6026],{},"After acquisition, that same visibility becomes the foundation for integration planning. You already know what the acquired system depends on. You can identify which services overlap with your existing stack. You can plan data migration with complete knowledge of existing flows. You can spot security issues before they become your security issues.",[12,6028,6029],{},"For companies that acquire frequently, this creates a repeatable, reliable process. Each acquisition starts with complete technical transparency instead of educated guesses.",[29,6031,6033],{"id":6032},"the-hidden-value-integration-confidence","The Hidden Value: Integration Confidence",[12,6035,6036],{},"Perhaps the most subtle value appears after the deal closes. Integration is where M&A value gets created or destroyed. You need to understand how the acquired system works to integrate it into your infrastructure without breaking things.",[12,6038,6039],{},"With complete dependency visibility from day one, your integration team knows exactly what they're working with. They can identify:",[237,6041,6042,6045,6048,6051],{},[240,6043,6044],{},"Which services need to be migrated first based on external dependencies",[240,6046,6047],{},"Where single points of failure exist in third-party integrations",[240,6049,6050],{},"What data classification exists in current flows to ensure compliant migration",[240,6052,6053],{},"Which connections can be consolidated with existing services you already pay for",[12,6055,6056],{},"This knowledge accelerates integration timelines and reduces the risk of post-acquisition surprises. You're not discovering critical dependencies six months in. You mapped everything on day one.",[29,6058,6060],{"id":6059},"a-new-standard-for-technical-due-diligence","A New Standard for Technical Due Diligence",[12,6062,6063],{},"Technical due diligence doesn't have to be a weeks-long archaeological dig through code and documentation. With instant visibility, it becomes an observational exercise. Deploy, observe, report.",[12,6065,6066],{},"The gap between what we think systems do and what they actually do has never been larger. Modern applications are distributed, containerized, and API-driven. They connect to dozens of external services. They evolve continuously. Traditional documentation-based due diligence can't keep up.",[12,6068,6069],{},"Runtime visibility can. By observing what actually happens at the kernel level where all connections originate, you get the ground truth. Not what might be true, not what should be true, but what is true.",[12,6071,6072],{},"For M&A teams, this is transformative. For target companies, it's liberating. For integration teams, it's essential. The question isn't whether you need this visibility. It's whether you can afford to make decisions without it.",[16,6074],{},[12,6076,6077],{},[250,6078,6079],{},"Want to see what Qtap would discover in your environment? The demo takes 60 seconds:",[1546,6081,6083],{"className":5413,"code":6082,"language":5415,"meta":184,"style":184},"curl -s https:\u002F\u002Fget.qpoint.io\u002Fdemo | sudo sh\n",[284,6084,6085],{"__ignoreMap":184},[1903,6086,6087,6089,6091,6094,6096,6098],{"class":1905,"line":1906},[1903,6088,286],{"class":3757},[1903,6090,5429],{"class":1983},[1903,6092,6093],{"class":2541}," https:\u002F\u002Fget.qpoint.io\u002Fdemo",[1903,6095,5435],{"class":1915},[1903,6097,5438],{"class":3757},[1903,6099,5441],{"class":2541},[12,6101,6102],{},[250,6103,6104],{},"For M&A and corporate development inquiries, reach out to learn how acquiring companies are using Qpoint to accelerate technical due diligence and de-risk acquisitions.",[3390,6106,6107],{},"html pre.shiki code .sYc7l, html code.shiki .sYc7l{--shiki-default:#FFA657;--shiki-light:#6F42C1;--shiki-dark:#FFA657}html pre.shiki code .sCeZ-, html code.shiki .sCeZ-{--shiki-default:#79C0FF;--shiki-light:#005CC5;--shiki-dark:#79C0FF}html pre.shiki code .sIrxU, html code.shiki .sIrxU{--shiki-default:#A5D6FF;--shiki-light:#032F62;--shiki-dark:#A5D6FF}html pre.shiki code .sLAjK, html code.shiki .sLAjK{--shiki-default:#FF7B72;--shiki-light:#D73A49;--shiki-dark:#FF7B72}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":184,"searchDepth":185,"depth":185,"links":6109},[6110,6111,6112,6113,6114,6115,6116,6117],{"id":5851,"depth":185,"text":5852},{"id":5870,"depth":185,"text":5871},{"id":5886,"depth":185,"text":5887},{"id":5922,"depth":185,"text":5923},{"id":5974,"depth":185,"text":5975},{"id":6016,"depth":185,"text":6017},{"id":6032,"depth":185,"text":6033},{"id":6059,"depth":185,"text":6060},"2025-10-28","Every CISO that's ever gone through an acquisition knows the technical due diligence black hole. Learn how simple visibility can transform weeks-long technical DD into a days-long observational exercise.",{},"\u002Fblog\u002Fma-due-diligence-black-box",{"title":5840,"description":6119},"ma-due-diligence-black-box","blog\u002Fma-due-diligence-black-box","_8uioVHOdSUika_Vr1mzh_JX_9itclME9s-XpubbLXM",{"id":6127,"title":6128,"author":5202,"body":6129,"date":6275,"description":6276,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":6277,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":6278,"navigation":201,"path":6279,"seo":6280,"slug":6281,"stem":6282,"subHeadline":6276,"tags":197,"__hash__":6283},"blog\u002Fblog\u002Fmanaging-external-api-dependency-risk.md","Managing External API Dependency Risk",{"type":9,"value":6130,"toc":6269},[6131,6134,6137,6141,6144,6182,6186,6189,6192,6196,6199,6202,6206,6209,6235,6239,6242,6256,6260,6263],[12,6132,6133],{},"Third-party APIs. Developers love and use them extensively, but the growing operational and security risks that they pose need to be taken seriously by operators and platform teams. Even modest-sized engineering teams can leverage hundreds of third-party API dependencies intertwined across their production environments. Core applications that have access to production databases and sensitive customer data are making thousands of requests per hour out to third party services and business partner APIs with little to no governance.",[12,6135,6136],{},"This proliferation of third-party API usage has platform engineering teams concerned, and for good reason. Cyber attacks and catastrophic data breaches are on the rise, many of which exploit the constantly morphing attack surface that now extends outside of the organization's direct control.",[73,6138,6140],{"id":6139},"the-risks-of-api-dependency-sprawl","The Risks of API Dependency Sprawl",[12,6142,6143],{},"Managing vendor relationships is challenging. Throw in a sprawling, interconnected web of APIs with access, dependencies and privileges that you can’t easily see or control, and the real pain begins. Third-party API dependencies can make your platform vulnerable to:",[237,6145,6146,6152,6158,6164,6170,6176],{},[240,6147,6148,6151],{},[155,6149,6150],{},"Vendor outages and rate limits."," If an API stops responding, it can cascade failures to your applications.",[240,6153,6154,6157],{},[155,6155,6156],{},"Compliance risk."," Without visibility into what data leaves your network, you may be in breach of compliance standards.",[240,6159,6160,6163],{},[155,6161,6162],{},"Slow remediation."," If you can’t find it, you can’t fix it. Issues with third-party APIs often require significant technical acumen and can be time consuming and costly to fix.",[240,6165,6166,6169],{},[155,6167,6168],{},"Missed SLA penalties."," Your customers have high expectations of you, and problems with third-party APIs can snowball into problems with your product if they go undetected and unresolved.",[240,6171,6172,6175],{},[155,6173,6174],{},"Improper third-party API configurations."," A poor configuration can trip up business and application functions.",[240,6177,6178,6181],{},[155,6179,6180],{},"Tedious API token assignment."," Provisioning, rotating and monitoring API tokens isn’t just a pain, it’s a potential security risk.",[73,6183,6185],{"id":6184},"limitations-of-in-house-tooling-and-first-party-solutions","Limitations of In-House Tooling and First Party Solutions",[12,6187,6188],{},"Deploying and maintaining tools in-house to take control of the egress traffic out to third-party APIs is challenging for platform teams, given the increasing complexity of cloud infrastructure and the sprawl of applications and technologies. Managing this traffic requires a dedicated, multi-disciplinary team performing extensive detective work, all while application failures continue to occur from outages and rate limits - and unseen liabilities cause major concerns for management.",[12,6190,6191],{},"Existing first party API management solutions are primarily focused on provisioning, managing, and securing internal APIs and ingress traffic. These solutions are not designed to monitor and secure egress traffic or to reduce the risk of an external API causing an outage for an internal application.",[73,6193,6195],{"id":6194},"improve-egress-visibility-and-control-with-qpoint","Improve Egress Visibility and Control with Qpoint",[12,6197,6198],{},"Enter Qpoint.",[12,6200,6201],{},"Our flexible toolkit enables a platform team to get unparalleled visibility into and control over the egress and third-party API traffic from their core applications.",[1179,6203,6205],{"id":6204},"tap-into-your-egress-traffic-with-qtap","Tap into Your Egress Traffic with Qtap",[12,6207,6208],{},"With Qtap, your team can get easy visibility into the egress traffic from your core applications and quickly get a handle on which applications are making external requests, what the payloads are, and what the destinations are. Qtap deploys as an eBPF agent on the host and supports:",[237,6210,6211,6214,6217,6220,6223,6229],{},[240,6212,6213],{},"**Endpoint Discovery: **Create a catalog of the sources and destinations for all egress traffic.",[240,6215,6216],{},"**Monitoring & Alerting: **Continuously monitor egress traffic and set up real-time alerts for anomalous behavior.",[240,6218,6219],{},"**Audit Logging: **Maintain detailed records for all outbound requests and responses.",[240,6221,6222],{},"**Third-Party API Reliability: **Rapidly detect anomalies or issues in third-party API traffic.",[240,6224,6225,6228],{},[155,6226,6227],{},"Rate Limit Detection",": Proactively alert when third-party API usage nears capacity limits.",[240,6230,6231,6234],{},[155,6232,6233],{},"Enhanced Debuggin","g: Enable developers to swiftly pinpoint and resolve egress-related production issues.",[1179,6236,6238],{"id":6237},"take-control-of-your-egress-traffic-with-qproxy","Take Control of Your Egress Traffic with Qproxy",[12,6240,6241],{},"Qproxy enables a platform team to go one step further by taking control over their traffic with a zero trust approach to increase overall operational resilience and minimize the risk of sensitive data exfiltration from one of their core applications or third-party libraries. Qproxy deploys on the network as an Envoy-based egress controller and supports:",[237,6243,6244,6247,6250],{},[240,6245,6246],{},"**Egress Access Control: **Restrict outbound access with identity-based security policies.",[240,6248,6249],{},"**API Token Injection: **Inject short-lived, highly scoped access tokens on-the-fly.",[240,6251,6252,6255],{},[155,6253,6254],{},"PII Scrubbing:"," Selectively filter out personally identifiable information from outbound traffic.",[73,6257,6259],{"id":6258},"getting-started-with-qpoint","Getting Started with Qpoint",[12,6261,6262],{},"Are you interested in reducing third-party API dependency risk by taking a holistic approach to egress traffic management?",[12,6264,6265,6268],{},[731,6266,6267],{"href":1311},"Arrange a demo"," with our solutions engineering team or explore on your own how Qpoint can enable your team to enhance observability, increase operational resilience, and lock down your egress traffic with a zero trust approach.",{"title":184,"searchDepth":185,"depth":185,"links":6270},[6271,6272,6273,6274],{"id":6139,"depth":191,"text":6140},{"id":6184,"depth":191,"text":6185},{"id":6194,"depth":191,"text":6195},{"id":6258,"depth":191,"text":6259},"2024-06-13","Discover how Qpoint can help operators manage third-party dependencies and increase operational resilience with a holistic approach to egress traffic observability and management.","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.06.13\u002FAsset-4@3x.png",{},"\u002Fblog\u002Fmanaging-external-api-dependency-risk",{"title":6128,"description":6276},"managing-external-api-dependency-risk","blog\u002Fmanaging-external-api-dependency-risk","jeMFEGoGOEuij72WCCrOWIqXURva70cmOjntpgvRwwY",{"id":6285,"title":6286,"author":5202,"body":6287,"date":6429,"description":6430,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":6431,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":6432,"navigation":201,"path":6433,"seo":6434,"slug":6435,"stem":6436,"subHeadline":6430,"tags":197,"__hash__":6437},"blog\u002Fblog\u002Fmanaging-external-integrations-in-production-environments.md","Managing External Integrations in Production Environments",{"type":9,"value":6288,"toc":6424},[6289,6292,6315,6321,6324,6327,6330,6334,6337,6375,6379,6382,6388,6394,6400,6406,6412,6414,6417,6419],[12,6290,6291],{},"In today's fast-paced tech environment, production applications increasingly rely on specialized third-party services for a wide variety of functions, including:",[237,6293,6294,6297,6300,6303,6306,6309,6312],{},[240,6295,6296],{},"Monitoring and analytics",[240,6298,6299],{},"Data storage and processing",[240,6301,6302],{},"Payment processing",[240,6304,6305],{},"Identity verification",[240,6307,6308],{},"Customer Relationship Management (CRM)",[240,6310,6311],{},"Continuous Integration \u002F Continuous Deployment (CI\u002FCD) processes",[240,6313,6314],{},"Helpdesk and support services",[12,6316,6317],{},[179,6318],{"alt":6319,"src":6320},"Traffic Egress@3x.png","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.06.28.managing.external\u002F20d2d682-b021-41a6-925b-6045939ef23f.png",[12,6322,6323],{},"These dependencies require seamless integration, but platform teams are often hampered by limited visibility into and control over the egress traffic that flows from in-house applications to external dependencies and elsewhere. This gap can hide security risks, hinder compliance monitoring, and impede service interaction optimization.",[12,6325,6326],{},"A universal egress management offering like Qpoint provides the ideal toolset to observe, secure, and optimize these interactions, and tackle the associated risks head-on.",[12,6328,6329],{},"The following sections delve into the risks associated with overlooking egress observability and security in production environments and illustrate how Qpoint bridges this gap to foster a secure and resilient operational environment.",[73,6331,6333],{"id":6332},"the-hidden-risks-of-external-service-integrations","The Hidden Risks of External Service Integrations",[12,6335,6336],{},"The following risks and challenges can arise from inadequate management of your production applications' external dependencies:",[237,6338,6339,6345,6351,6357,6363,6369],{},[240,6340,6341,6344],{},[155,6342,6343],{},"Lack of Awareness of Dependencies",": The ignorance about which third parties your applications are liaising with crafts a shadow zone, paving the way for potential security risks. It also impedes swift incident resolution, turning issue source identification into a complex maze.",[240,6346,6347,6350],{},[155,6348,6349],{},"Undetected Data Exfiltration",": A blind eye to the type of data exiting your production environs could lead to unintended sharing of sensitive or regulated information. This unmonitored exfiltration can spell compliance violations, legal backlashes, and a tarnished reputation.",[240,6352,6353,6356],{},[155,6354,6355],{},"Data Breaches",": Feeble API security could invite unauthorized data access, culminating in data breaches, a financially and reputationally draining ordeal.",[240,6358,6359,6362],{},[155,6360,6361],{},"Compliance Violations",": The haze over API interactions can lead to non-compliance with regulatory mandates like GDPR or HIPAA, unfurling hefty fines and legal hassles.",[240,6364,6365,6368],{},[155,6366,6367],{},"Operational Disruptions",": Lax monitoring of third-party APIs’ uptime can trigger unexpected downtime, upsetting the operational rhythm. A vigilant monitoring system like Qpoint ensures real-time insight, enabling prompt actions to uphold operational continuity.",[240,6370,6371,6374],{},[155,6372,6373],{},"Loss of Customer Trust",": Security lapses and disrupted user experience can severely dent customer trust, driving them towards competitor shores.",[73,6376,6378],{"id":6377},"mitigating-risk-with-egress-visibility-and-control","Mitigating Risk with Egress Visibility and Control",[12,6380,6381],{},"Qpoint serves as an essential toolkit for platform teams and operators, offering unparalleled visibility and control over your external dependencies and traffic flows as well as defense against threats. By streamlining security and traffic management, Qpoint secures your digital resources and keeps your operations running smoothly. Here’s the breakdown:",[12,6383,6384,6387],{},[155,6385,6386],{},"Visibility and Control",": Qpoint illuminates the once shadowy realm of third-party dependencies by categorizing API traffic, granting immediate access control. This transparency ensures that any abnormal interaction or security threat is detected and mitigated promptly.",[12,6389,6390,6393],{},[155,6391,6392],{},"Operational Resilience",": Qpoint's vigilant monitoring of API uptime preemptively addresses potential downtime issues. The system's ability to function as a dynamic load balancer and traffic rerouter minimizes operational disruptions, thereby maintaining operational rhythm.",[12,6395,6396,6399],{},[155,6397,6398],{},"Data Exfiltration Guard",": With Qpoint's advanced rule engine, your HTTP traffic is not just redirected but inspected. Headers and payloads are scrutinized, ensuring that no sensitive data leaves your network without explicit permission, maintaining compliance and protecting your reputation.",[12,6401,6402,6405],{},[155,6403,6404],{},"Compliance Assurance",": Real-time alerts and comprehensive logging are more than just informational tools; they're the backbone of compliance. Integration with existing incident management systems ensures that every API interaction is logged, traceable, and aligned with GDPR, HIPAA, or other regulatory frameworks.",[12,6407,6408,6411],{},[155,6409,6410],{},"Trust Reinforcement",": By safeguarding against security lapses and ensuring an uninterrupted user experience, Qpoint helps reinforce customer trust. Clients rest easy knowing that their service providers employ state-of-the-art API management solutions.",[73,6413,4834],{"id":4833},[12,6415,6416],{},"In the current climate of digital threats and stringent compliance requirements, Qpoint stands out as a pivotal solution for organizations aiming to protect and streamline their API-driven interactions. By choosing Qpoint, businesses can focus on growth and innovation, leaving the complexities of egress-related security in the hands of a capable, sophisticated system designed to address the complexities of today’s interconnected applications and platforms.",[12,6418,5176],{},[12,6420,5179,6421,6423],{},[731,6422,3325],{"href":4155}," can enable your team to enhance observability, increase operational resilience, and lock down your external traffic with a zero trust approach.",{"title":184,"searchDepth":185,"depth":185,"links":6425},[6426,6427,6428],{"id":6332,"depth":191,"text":6333},{"id":6377,"depth":191,"text":6378},{"id":4833,"depth":191,"text":4834},"2024-06-28","External service Integrations and their hidden challenges are the new frontier for platform teams and operators.","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.06.28.managing.external\u002Fblog-header-1.jpg",{},"\u002Fblog\u002Fmanaging-external-integrations-in-production-environments",{"title":6286,"description":6430},"managing-external-integrations-in-production-environments","blog\u002Fmanaging-external-integrations-in-production-environments","CXLoy5CtXLP9JY3ZTpjqFE98RuIpbu3D0IeHyrME1kw",{"id":6439,"title":6440,"author":5565,"body":6441,"date":6519,"description":6520,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":6521,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":6522,"navigation":201,"path":6523,"seo":6524,"slug":6525,"stem":6526,"subHeadline":6520,"tags":197,"__hash__":6527},"blog\u002Fblog\u002Fmeeting-regulatory-compliance-requirements-for-your-external-integrations.md","Meeting Regulatory Compliance Requirements for Your External Integrations",{"type":9,"value":6442,"toc":6511},[6443,6446,6450,6461,6465,6468,6472,6478,6482,6485,6489,6492,6496,6501,6508],[12,6444,6445],{},"Modern production environments are becoming increasingly interconnected across clouds, on-prem, and SaaS services. A key challenge for platform engineering teams that need to comply with regulatory frameworks like FEDRAMP, ISO 27001, PCI, and SOC2 lies in effectively managing and securing the egress traffic from their core applications (the HTTP and other requests to external endpoints outside the network). Qpoint’s universal egress visibility and control platform provides the flexibility that platform teams need to meet their compliance requirements in a digital landscape that continues to rapidly evolve.",[73,6447,6449],{"id":6448},"egress-traffic-is-often-overlooked","Egress Traffic is Often Overlooked",[12,6451,6452,6456,6457,6460],{},[731,6453,6455],{"href":6454},"\u002Fblog\u002Fconquering-the--hidden-challenges-of-external-integrations-with-qpoint","Managing egress traffic"," is a complex challenge that many organizations overlook - an oversight that can result in the exfiltration of sensitive data by unauthorized internal actors or malicious intruders, making it a critical focus area for regulatory compliance. Qpoint addresses this challenge by offering unparalleled visibility and control over egress, empowering platform engineering teams to confidently monitor, manage, and ",[731,6458,6459],{"href":1188},"secure egress traffic flows","​ using a consistent workflow across their production environments. This proactive approach to egress traffic management ensures that potential compliance violations and vulnerabilities are detected and mitigated before they can cause significant harm.",[73,6462,6464],{"id":6463},"securing-egress-for-regulatory-compliance","Securing Egress for Regulatory Compliance",[12,6466,6467],{},"Compliance frameworks like FEDRAMP and ISO 27001 demand rigorous observability and security measures, including comprehensive monitoring of data flows, controlling access to sensitive information, and ensuring data integrity and confidentiality during transit. These frameworks emphasize the importance of securing both incoming and outgoing data, which includes monitoring egress traffic to prevent unauthorized data exfiltration. By addressing the security of data flows in both directions, these standards mitigate the risks associated with data security, making them essential for businesses handling sensitive internal or customer information. Adhering to these standards not only protects the organization from potential data breaches but also builds trust with customers and partners by demonstrating a commitment to maintaining high security standards.",[73,6469,6471],{"id":6470},"improve-egress-observability-with-qtap","Improve Egress Observability with Qtap",[12,6473,6474,6475,6477],{},"Qtap is a crucial first step for a platform team looking to improve its regulatory compliance posture. Leveraging the latest ",[731,6476,1221],{"href":1220},", Qtap enables a team to effortlessly discover which applications are making external requests, to which endpoints, and what the payloads are. This capability is essential for preventing unauthorized data exfiltration and ensuring that PII and other sensitive information does not leave the network without proper oversight. By enabling a team to map sources and destinations for all PII, Qtap can validate compliance with data protection laws like GDPR, HIPAA, and others. Qtap also enables an organization to systematically perform detailed audit logging of all outbound requests and responses from their core applications, ensuring traceability and accountability for security investigations and forensic analysis.",[73,6479,6481],{"id":6480},"zero-trust-security-for-egress-traffic-with-qproxy","Zero Trust Security for Egress Traffic with Qproxy",[12,6483,6484],{},"Qproxy enables a platform team to take its compliance strategy to the next level with access control capabilities for egress that limit external communication to approved sources and destinations only - based on identity. And to further reduce the risk of accidental data exposure or a data breach by an attacker, Qproxy can selectively scrub PII from egress traffic before it leaves the network to ensure compliance with privacy regulations and to protect sensitive information. This capability is highly customizable as described in the next section.",[73,6486,6488],{"id":6487},"extend-qpoint-functionality-with-next-generation-middleware","Extend Qpoint Functionality with Next Generation Middleware",[12,6490,6491],{},"One of Qpoint's strengths is its extensible and flexible middleware framework which enables a team to adapt and customize Qtap or Qproxy capabilities to meet specific compliance and security requirements. This flexibility ensures that Qpoint can be integrated into an existing platform or production environment without disrupting established workflows​​. Platform engineers can write and deploy custom middleware functions in any WASM supported language to address any unique challenges not currently supported by the Qpoint middleware catalog.",[73,6493,6495],{"id":6494},"meet-and-exceed-regulatory-compliance-regulations-with-qpoint","Meet and Exceed Regulatory Compliance Regulations with Qpoint",[12,6497,6498,6500],{},[731,6499,3325],{"href":4155}," stands out as an egress focused compliance enabler by offering a flexible toolset that platform teams can use to meet the stringent requirements of various regulatory frameworks for their production environments. By integrating Qpoint’s solutions, a business can get unparalleled visibility into and robust governance over the egress traffic from the core applications that have access to its most sensitive data, to reinforce their compliance posture and maintain trust with their stakeholders.",[12,6502,6503,6504,6507],{},"Are you interested in further exploring how Qpoint can transform your regulatory compliance strategy for your most critical production environments? ",[731,6505,6506],{"href":1311},"Engage our solutions engineering team"," for a detailed demonstration and discussion on the best fit for the unique needs of your organization.",[12,6509,6510],{},"Stay tuned for additional posts in this series which will detail how Qpoint can help your organization meet your egress related compliance requirements for specific frameworks including FEDRAMP, ISO 27001, PCI\u002FDSS, SOC2, and others.",{"title":184,"searchDepth":185,"depth":185,"links":6512},[6513,6514,6515,6516,6517,6518],{"id":6448,"depth":191,"text":6449},{"id":6463,"depth":191,"text":6464},{"id":6470,"depth":191,"text":6471},{"id":6480,"depth":191,"text":6481},{"id":6487,"depth":191,"text":6488},{"id":6494,"depth":191,"text":6495},"2024-05-23","This is Part 1 of our series on how platform teams can leverage Qpoint's visibility and control capabilities for external integrations to meet regulatory compliance requirements for their production environments.","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.05.23\u002Fregulatory-compliance-1-listing.png",{},"\u002Fblog\u002Fmeeting-regulatory-compliance-requirements-for-your-external-integrations",{"title":6440,"description":6520},"meeting-regulatory-compliance-requirements-for-your-external-integrations","blog\u002Fmeeting-regulatory-compliance-requirements-for-your-external-integrations","GHYNNpfNVICOl9pwnStIMaFWn5sVHLgCJ-uV01m0vFQ",{"id":6529,"title":6530,"author":5565,"body":6531,"date":6670,"description":6671,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":6672,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":6673,"navigation":201,"path":6674,"seo":6675,"slug":6676,"stem":6677,"subHeadline":6671,"tags":197,"__hash__":6678},"blog\u002Fblog\u002Fmitigating-software-supply-chain-risk-with-qpoint.md","Mitigating Software Supply Chain Risk with Qpoint",{"type":9,"value":6532,"toc":6665},[6533,6536,6540,6544,6547,6585,6589,6592,6615,6619,6622,6626,6631,6651,6653,6659,6662],[12,6534,6535],{},"Modern developers increasingly rely on a complex web of external services, open source libraries, and third-party frameworks to drive business value as efficiently and effectively as possible. While beneficial for rapid innovation, this approach can introduce significant risk due to heavy reliance on a \"software supply chain\". Vulnerabilities, malicious code, and quality issues embedded within the various third-party components that comprise a modern system can cause significant harm to an organization from both an operational reliability and a security perspective. To mitigate these risks, comprehensive visibility into the egress traffic from your production environments is paramount.",[73,6537,6539],{"id":6538},"understanding-the-software-supply-chain","Understanding the Software Supply Chain",[1179,6541,6543],{"id":6542},"modern-software-is-highly-interconnected","Modern Software is Highly Interconnected",[12,6545,6546],{},"Modern software systems are rarely built in isolation. They depend heavily on third-party dependencies, open-source projects, and integrations with various external services. This complexity creates several key issues:",[237,6548,6549,6555,6561,6567,6573,6579],{},[240,6550,6551,6554],{},[155,6552,6553],{},"Third-Party Dependencies:"," Many software applications rely on third-party libraries and frameworks, which may harbor undiscovered vulnerabilities or be subject to inadequate update practices.",[240,6556,6557,6560],{},[155,6558,6559],{},"Open Source Risks:"," Open-source software, while cost-effective and widely adopted, can be a target for attackers. Malicious actors may inject harmful code into popular open-source projects, compromising any projects or platforms that adopt these components.",[240,6562,6563,6566],{},[155,6564,6565],{},"Insufficient Vetting:"," Engineering teams often integrate third-party components without thorough security vetting, increasing the risk of incorporating insecure or unverified software into their systems.",[240,6568,6569,6572],{},[155,6570,6571],{},"Complex Integration:"," The integration of diverse components from multiple sources can create complex dependencies, making it difficult to identify and resolve security gaps and operational issues.",[240,6574,6575,6578],{},[155,6576,6577],{},"Malware Insertion:"," Attackers can infiltrate the open source development process, inserting malware at a given stage - during code development, build processes, or through compromised software updates.",[240,6580,6581,6584],{},[155,6582,6583],{},"Version Control and Updates:"," Keeping track of all components and ensuring they are updated to the latest secure versions is challenging, leaving systems vulnerable to known exploits.",[1179,6586,6588],{"id":6587},"consequences-of-ignoring-software-supply-chain-risks","Consequences of Ignoring Software Supply Chain Risks",[12,6590,6591],{},"Ignoring software supply chain risks can lead to severe and far-reaching consequences, including:",[237,6593,6594,6600,6606,6609],{},[240,6595,6596,6599],{},[155,6597,6598],{},"Operational Disruptions:"," Malicious code or integration issues can cause software malfunctions, leading to downtime and service disruption.",[240,6601,6602,6605],{},[155,6603,6604],{},"Security Breaches:"," Vulnerabilities in third-party components can be exploited, leading to unauthorized access, data breaches, and other security incidents.",[240,6607,6608],{},"**Reputation Damage: **Security incidents resulting from supply chain vulnerabilities can severely damage an organization's reputation and customer trust.",[240,6610,6611,6614],{},[155,6612,6613],{},"Compliance Violations:"," Failing to manage software supply chain risk can result in non-compliance with industry regulations and standards, which can lead to legal or financial exposure.",[73,6616,6618],{"id":6617},"mitigate-software-supply-chain-risk-with-qpoint","Mitigate Software Supply Chain Risk with Qpoint",[12,6620,6621],{},"By gaining comprehensive visibility into egress traffic flows, operators can identify, track, and manage the interactions between their core applications, local dependencies, and external systems. This capability is crucial to mitigate any risks, vulnerabilities, or instability that may have been introduced by third-party libraries or open source tools, and can be accomplished by ensuring that all outgoing communications are legitimate, reliable, secure, and compliant with the organization’s policies.",[1179,6623,6625],{"id":6624},"get-started-with-observability","Get Started with Observability",[12,6627,1628,6628,6630],{},[731,6629,3325],{"href":4155},", operators can mitigate supply chain risk with an easily deployed and extensible eBPF-based egress observability solution that can discover external dependencies, monitor egress traffic, alert on anomalous behavior, and scan for sensitive data exfiltration. Here are just a few of Qtap’s capabilities:",[237,6632,6633,6636,6639,6642,6648],{},[240,6634,6635],{},"**Endpoint Discovery: **Create a catalog of the sources and destinations for all egress traffic to serve as a baseline to enforce security policies, manage access controls, and detect potentially malicious activities.",[240,6637,6638],{},"**Monitoring & Alerting: **Continuously monitor egress traffic and set up real-time alerts for anomalous behavior, to enable your team to swiftly detect and address issues with third-party dependencies.",[240,6640,6641],{},"**Audit Logging: **Maintain a comprehensive log for all egress traffic from your core applications to ensure traceability and accountability for security and compliance purposes.",[240,6643,6644,6647],{},[155,6645,6646],{},"Forensic Analysis",": Enable developers to swiftly pinpoint and resolve production issues by making precise, actionable request level data available.",[240,6649,6650],{},"**PII Mapping: **Monitor for PII in traffic flows and generate exfiltration maps to determine which workloads are sending requests that contain specific types of sensitive information.",[29,6652,4834],{"id":4833},[12,6654,6655,6656,6658],{},"Software supply chain risk is ever-present in the modern software development landscape, as reliance on third-party libraries, open-source components, and external services continues to grow. Mitigating this risk starts with comprehensive visibility into the egress traffic generated by production applications and by extension, their dependencies. ",[731,6657,3329],{"href":1631}," provides the essential tools to address these challenges by enabling platform teams and operators to proactively manage and secure their software supply chain - ultimately enhancing overall system reliability and protecting the organization from potential harm.",[12,6660,6661],{},"Are you interested in getting visibility into the egress traffic from your core applications and the third-party software and libraries running on your production networks?",[12,6663,6664],{},"Explore how Qpoint can enable your team to enhance egress observability and increase operational resilience in the face of the complexity created by your third-party dependencies and external service integrations.",{"title":184,"searchDepth":185,"depth":185,"links":6666},[6667,6668,6669],{"id":6538,"depth":191,"text":6539},{"id":6617,"depth":191,"text":6618},{"id":4833,"depth":185,"text":4834},"2024-06-25","The modern software development paradigm enables rapid innovation, but developer reliance on third-party libraries, frameworks, and external services can introduce software supply chain risk as a result.","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.06.25\u002Fsoftware-supply-chain-listing.png",{},"\u002Fblog\u002Fmitigating-software-supply-chain-risk-with-qpoint",{"title":6530,"description":6671},"mitigating-software-supply-chain-risk-with-qpoint","blog\u002Fmitigating-software-supply-chain-risk-with-qpoint","O4FCwWz7bucCfH2Hb6NAwFi5rixE51gfTEDkQ-S59Ug",{"id":6680,"title":6681,"author":5202,"body":6682,"date":6938,"description":6939,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":6940,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":6941,"navigation":201,"path":6942,"seo":6943,"slug":6944,"stem":6945,"subHeadline":6939,"tags":197,"__hash__":6946},"blog\u002Fblog\u002Fnew-year-new-user-experience.md","New Year, New User Experience!",{"type":9,"value":6683,"toc":6932},[6684,6687,6704,6707,6711,6714,6720,6724,6727,6732,6736,6739,6743,6746,6751,6755,6758,6763,6767,6770,6775,6779,6782,6787,6790,6793,6798,6803,6806,6812,6818,6822,6825,6829,6832,6838,6842,6845,6851,6855,6858,6864,6868,6871,6877,6881,6884,6890,6895,6898,6904,6908,6911,6917],[12,6685,6686],{},"Happy New Year 2024 from the Qpoint team!",[12,6688,6689,6690,6694,6695,6699,6700,221],{},"After spending most of 2024 establishing a solid foundation for the Qpoint platform with our new ",[731,6691,6693],{"href":6692},"\u002Fresources\u002Ftap-into-your-egress-traffic-with-ebpf","eBPF agent",", we managed to sprint to the finish line and deliver a completely refreshed control plane experience. Our latest updates deliver a more intuitive interface so that ops teams can gain even deeper visibility to ",[731,6696,6698],{"href":6697},"\u002Fresources\u002Fthe-hidden-risks-of-third-party-api-dependencies","resolve issues faster"," and maximize third-party API performance and ",[731,6701,6703],{"href":6702},"\u002Fresources\u002Fimproving-platform-reliability-with-qpoint","internal platform reliability",[12,6705,6706],{},"Here’s a look at what’s new:",[73,6708,6710],{"id":6709},"new-dashboard","New Dashboard",[12,6712,6713],{},"We dropped a major update to our dashboard landing page which provides an improved overview of your third-party API ecosystem, with at-a-glance insights into key metrics and traffic trends to enable informed decisions and easy drill down after a quick review.",[12,6715,6716],{},[179,6717],{"alt":6718,"src":6719},"Dashboard","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.01.09.new.year,\u002Fe148ba77-b969-45d8-902f-7ee5ff189d3b.png",[73,6721,6723],{"id":6722},"sticky-filters","Sticky Filters",[12,6725,6726],{},"This update introduces stackable filters that remain active as you move through the interface, enabling a seamless workflow.",[12,6728,6729],{},[179,6730],{"alt":6723,"src":6731},"\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.01.09.new.year,\u002F3a01b864-227a-4c54-83ba-83249e3fedff.png",[73,6733,6735],{"id":6734},"updated-traffic-page","Updated Traffic Page",[12,6737,6738],{},"Our updated traffic page organizes critical data about your third-party integrations into intuitive sections for performance, availability, bandwidth, geolocations, connections, and HTTP requests - with real-time visualizations for easy monitoring, insights, and decision making.",[1179,6740,6742],{"id":6741},"performance","Performance",[12,6744,6745],{},"Analyze HTTP request connection rates, throughput, and response times to identify bottlenecks and maintain high-performing integrations.",[12,6747,6748],{},[179,6749],{"alt":6742,"src":6750},"\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.01.09.new.year,\u002F9a309d86-eca3-44cb-b3d5-3d7e646d2e69.png",[1179,6752,6754],{"id":6753},"availability","Availability",[12,6756,6757],{},"Track uptime and error rates for external services to proactively manage reliability issues.",[12,6759,6760],{},[179,6761],{"alt":6754,"src":6762},"\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.01.09.new.year,\u002Fc20674ba-a7cb-4c04-ab6e-4af03bab7fe4.png",[1179,6764,6766],{"id":6765},"bandwidth","Bandwidth",[12,6768,6769],{},"Monitor data flow volumes to understand how traffic usage impacts cloud costs across vendors.",[12,6771,6772],{},[179,6773],{"alt":6766,"src":6774},"\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.01.09.new.year,\u002F084722c6-b5c6-4c90-adf7-344807c53a02.png",[1179,6776,6778],{"id":6777},"geolocations","Geolocations",[12,6780,6781],{},"Gain insight into where requests originate or terminate geographically to ensure efficient routing and compliance with regional requirements and regulations.",[12,6783,6784],{},[179,6785],{"alt":6778,"src":6786},"\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.01.09.new.year,\u002Fade56522-2456-4aff-8212-515827c31d8c.png",[1179,6788,5271],{"id":6789},"connections",[12,6791,6792],{},"Visualize active connections between internal applications and external APIs to identify dependency patterns and ensure proper traffic flow.",[12,6794,6795],{},[179,6796],{"alt":5271,"src":6797},"\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.01.09.new.year,\u002Fe0f4a5b8-0210-49fc-ba86-476dc6af213a.png",[12,6799,6800],{},[155,6801,6802],{},"HTTP Requests",[12,6804,6805],{},"Inspect detailed HTTP request data, including headers and response code - to troubleshoot errors and ensure consistent service quality.",[12,6807,6808],{},[179,6809],{"alt":6810,"src":6811},"HTTP Requests 1","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.01.09.new.year,\u002Faa010f4a-e442-417e-9639-58b0d32a98ad.png",[12,6813,6814],{},[179,6815],{"alt":6816,"src":6817},"HTTP Requests 2","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.01.09.new.year,\u002Fd1893b5c-ff12-484b-92f3-862ca4665c9c.png",[73,6819,6821],{"id":6820},"new-inventory-page","New Inventory Page",[12,6823,6824],{},"Our new Inventory section consolidates data from all third-party integrations, offering a unified view across vendors, clients (apps), endpoints, and API tokens. This section ensures teams can manage their dependencies efficiently while reducing blind spots and mitigating potential security risks.",[1179,6826,6828],{"id":6827},"vendor-inventory","Vendor Inventory",[12,6830,6831],{},"Get a complete catalog of your external vendors with detailed analytics to track usage, performance, and undocumented endpoints.",[12,6833,6834],{},[179,6835],{"alt":6836,"src":6837},"Vendors","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.01.09.new.year,\u002F10c897c4-1970-477e-b557-c47dca02d623.png",[1179,6839,6841],{"id":6840},"unknown-vendor-details","Unknown Vendor Details",[12,6843,6844],{},"Identify traffic originating from or targeting undocumented vendors, providing clarity into potential risks or unintentional dependencies.",[12,6846,6847],{},[179,6848],{"alt":6849,"src":6850},"Vendors 2","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.01.09.new.year,\u002F4025a305-586c-4552-8f4e-4b2be7688cff.png",[1179,6852,6854],{"id":6853},"client-inventory","Client Inventory",[12,6856,6857],{},"Map how internal applications interact with external vendors and APIs to ensure smooth and efficient operations.",[12,6859,6860],{},[179,6861],{"alt":6862,"src":6863},"Clients","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.01.09.new.year,\u002F9e334483-86cd-4969-972a-6cf3cf7cd9d5.png",[1179,6865,6867],{"id":6866},"endpoint-inventory","Endpoint Inventory",[12,6869,6870],{},"Catalog API endpoints to manage redundancies, improve traffic patterns, and streamline debugging.",[12,6872,6873],{},[179,6874],{"alt":6875,"src":6876},"Endpoints","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.01.09.new.year,\u002Ff685f0c2-d4a7-4376-a3f4-48169e920fd9.png",[1179,6878,6880],{"id":6879},"endpoint-details","Endpoint Details",[12,6882,6883],{},"Drill down into individual API endpoints to view granular metrics for effective troubleshooting.",[12,6885,6886],{},[179,6887],{"alt":6888,"src":6889},"Endpoints 2","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.01.09.new.year,\u002Ffeb49ad0-7978-4708-9034-914c388ac7d5.png",[12,6891,6892],{},[155,6893,6894],{},"API Token Inventory",[12,6896,6897],{},"Maintain an inventory of active tokens to reduce risks from misconfigured or compromised credentials. Search by token hash to identify specific tokens.",[12,6899,6900],{},[179,6901],{"alt":6902,"src":6903},"API Tokens 1","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.01.09.new.year,\u002F04893c57-e351-4b71-a28f-59c007df7bcc.png",[1179,6905,6907],{"id":6906},"api-token-details","API Token Details",[12,6909,6910],{},"Drill down to view key metrics like connections, bandwidth and error rates for individual tokens for precise and efficient analysis.",[12,6912,6913],{},[179,6914],{"alt":6915,"src":6916},"API Tokens 2","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.01.09.new.year,\u002F5ac2afeb-8673-42f0-952c-f0cb26d93299.png",[12,6918,6919],{},[155,6920,6921,6922,6927,6928,6931],{},"Get started today with ",[731,6923,6926],{"href":6924,"rel":6925},"https:\u002F\u002Fapp.qpoint.io\u002Fsign-up",[735],"our free tier"," to experience our new UI and discover your third-party API footprint in minutes. Check out our ",[731,6929,1307],{"href":1305,"rel":6930},[735],", take it for a spin, and let us know what you think!",{"title":184,"searchDepth":185,"depth":185,"links":6933},[6934,6935,6936,6937],{"id":6709,"depth":191,"text":6710},{"id":6722,"depth":191,"text":6723},{"id":6734,"depth":191,"text":6735},{"id":6820,"depth":191,"text":6821},"2025-01-09","We sprinted to the finish line in 2024 to deliver a major update to our user interface and workflow.","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.01.09.new.year,\u002FDashboard.png",{},"\u002Fblog\u002Fnew-year-new-user-experience",{"title":6681,"description":6939},"new-year-new-user-experience","blog\u002Fnew-year-new-user-experience","rdR3kiuY8smVKQ18aLh-qrYPWQUIopzAODEmb34iFxU",{"id":6948,"title":6949,"author":5202,"body":6950,"date":7084,"description":7085,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":7086,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":7087,"navigation":201,"path":7088,"seo":7089,"slug":7090,"stem":7091,"subHeadline":7092,"tags":197,"__hash__":7093},"blog\u002Fblog\u002Fqpoint-closes-pre-seed-funding-and-launches-ebpf-based-visibility-and-control-for-critical-external-services.md","Qpoint Closes Pre-Seed Funding and Launches eBPF-based Monitoring and Control for External APIs and Services",{"type":9,"value":6951,"toc":7080},[6952,6960,6963,6966,6979,6989,6992,6998,7005,7016,7019,7057,7060,7063,7069],[12,6953,6954,6955,6959],{},"We’ll jump into the ",[731,6956,6958],{"href":6957},"\u002Fpre-seed-funding-press-release","news"," in a second, but first, the back story.",[12,6961,6962],{},"The meteoric rise of cloud-based infrastructure and services over the last decade has completely changed how modern applications are built and deployed. Gone are the days of self-contained monolithic architectures where every dependency runs within your corporate network. Modern developers instead rely on a wide range of external APIs and services to power essential features and deliver business outcomes faster. These integrations fuel essential functions like payments, authentication, provisioning, and analytics—but they're often behind some of operators' worst days and most challenging moments.",[12,6964,6965],{},"Outages. Slowdowns. Surprise rate limiting. Unrestricted external access. Privacy and compliance blind spots. Unattributed cloud costs and bandwidth usage. Finger pointing. And painfully slow, system-by-system troubleshooting by a team of seasoned operators from your company and the vendor drastically slows mean-time-to-resolution (MTTR) for business impacting issues.",[12,6967,6968,6969,6973,6974,6978],{},"The Qpoint team lived these ",[731,6970,6972],{"href":6971},"\u002Fresources\u002Fmanaging-external-integrations-in-production-environments","external integration problems"," firsthand at some of the most popular software and infrastructure companies in the world including Shopify, Instacart, NS1 and HashiCorp. It’s a huge blind spot for any company — including large enterprises with a stack of legacy ",[731,6975,6977],{"href":6976},"\u002Fresources\u002Fwhats-the-difference-between-my-apm-tool-and-qpoint","application performance monitoring (APM)",", network observability, and API management tools.",[12,6980,6981,6982,6985,6986,6988],{},"A company can easily have hundreds of external API integrations that — until now — were very difficult to monitor and control. While these dependencies are technically not ",[250,6983,6984],{},"your"," services, they are increasingly ",[250,6987,6984],{}," problem.",[12,6990,6991],{},"So, we decided to do something about it.",[73,6993,6995],{"id":6994},"third-party-api-observability-and-security-powered-by-ebpf",[155,6996,6997],{},"Third-Party API Observability and Security Powered by eBPF",[12,6999,7000,7001,7004],{},"With two years of innovation and testing behind us, we’re pleased to announce both our ",[731,7002,7003],{"href":6957},"pre-seed funding"," and the availability of the eBPF-based Qpoint platform.",[12,7006,7007,7008,7011,7012,7015],{},"Qpoint is the first purpose-built solution to enable operators to easily see and control their mission-critical external services and traffic. Powered by ",[731,7009,7010],{"href":1220},"eBPF",", Qpoint transparently taps into the flow of requests between your apps and their third-party dependencies to deliver game changing insights ",[250,7013,7014],{},"without data leaving your environment",". Deployed in just minutes, Qpoint delivers instant visibility and the foundation needed to boost operational resilience and enforce a true zero-trust security model — with zero compromises for developers driving innovation.",[12,7017,7018],{},"Operators and SREs can use Qpoint to address any integration-related pain point, including:",[237,7020,7021,7027,7033,7039,7045,7051],{},[240,7022,7023,7026],{},[155,7024,7025],{},"External Service Reliability:"," Immediately identify issues or anomalous behavior with external services to minimize impacts on mission-critical applications.",[240,7028,7029,7032],{},[155,7030,7031],{},"Rate Limit Detection:"," Continuously track external API usage, providing alerts when nearing capacity limits to prevent throttling and maintain availability for production systems.",[240,7034,7035,7038],{},[155,7036,7037],{},"Root Cause Analysis and Debugging:"," Enable improved analysis and troubleshooting of integration-related issues for dramatically faster mean time to resolution.",[240,7040,7041,7044],{},[155,7042,7043],{},"Cloud Bandwidth and Billing Attribution:"," Get insight into bandwidth utilization to accurately attribute resource usage and cloud costs to specific teams or projects.",[240,7046,7047,7050],{},[155,7048,7049],{},"Vendor Audit Trails:"," Track vendor API interactions to provide clear evidence of SLA violations and ensure vendor accountability",[240,7052,7053,7056],{},[155,7054,7055],{},"Zero Trust Security:"," Limit access to external endpoints to only those applications that have been explicitly authorized, minimizing the risk of unauthorized access and sensitive data exposure.",[12,7058,7059],{},"Qpoint transforms how companies oversee their external service integrations. It gives ops teams confidence about what is happening within the systems they are responsible for, and the ability to quickly see what’s not working and dramatically speed remediation.",[12,7061,7062],{},"Special thanks to Mango Capital (lead investor), Preface Ventures, Scribble Ventures, and Bloomberg Beta for recognizing the incredible opportunity to fill the widening gap in today’s tools that fails to cover critical external services integrations at companies of all sizes and across all industries.",[73,7064,7066],{"id":7065},"get-instant-visibility-into-your-external-dependencies-and-traffic",[155,7067,7068],{},"Get Instant Visibility Into Your External Dependencies and Traffic",[12,7070,405,7071,7075,7076,7079],{},[731,7072,7074],{"href":6924,"rel":7073},[735],"try Qpoint"," for yourself in just minutes. Check out our ",[731,7077,1307],{"href":1305,"rel":7078},[735],", take it for a spin, and let us know what you think.",{"title":184,"searchDepth":185,"depth":185,"links":7081},[7082,7083],{"id":6994,"depth":191,"text":6997},{"id":7065,"depth":191,"text":7068},"2024-10-22","In line with Qpoint's announcement of pre-seed funding, it has also launched a new eBPF-based visibility and control platform to easily see and control external services.","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.10.22\u002Falternate-header@3x-8.png",{},"\u002Fblog\u002Fqpoint-closes-pre-seed-funding-and-launches-ebpf-based-visibility-and-control-for-critical-external-services",{"title":6949,"description":7085},"qpoint-closes-pre-seed-funding-and-launches-ebpf-based-visibility-and-control-for-critical-external-services","blog\u002Fqpoint-closes-pre-seed-funding-and-launches-ebpf-based-visibility-and-control-for-critical-external-services","It's an exciting day for us at Qpoint as years of hard work culminate into some key milestones.","RX7hat0lc8KzS5wjuh1M-f0bE_IEIfk6ThQKtX2H5io",{"id":7095,"title":7096,"author":5202,"body":7097,"date":7273,"description":7274,"excerpt":197,"extension":198,"eyebrow":7275,"heroImage":7276,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":7277,"navigation":201,"path":7278,"seo":7279,"slug":7280,"stem":7281,"subHeadline":7282,"tags":197,"__hash__":7283},"blog\u002Fblog\u002Fqtap-see-through-encryption.md","Security Observability for the Encrypted Cloud",{"type":9,"value":7098,"toc":7262},[7099,7107,7111,7114,7117,7120,7123,7126,7130,7133,7136,7139,7143,7146,7149,7152,7155,7158,7161,7165,7168,7171,7174,7177,7180,7186,7189,7193,7196,7199,7202,7205,7208,7211,7217,7221,7224,7228,7231,7245,7249,7256,7259],[12,7100,7101,7102,7106],{},"Today, I'm thrilled to announce the open-source release of ",[731,7103,7105],{"href":5496,"rel":7104},[735],"Q.Tap"," - our eBPF powered agent that transforms security observability by providing visibility into encrypted traffic without proxies, code changes, or complex installations.",[29,7108,7110],{"id":7109},"the-journey-why-we-built-qtap","The Journey: Why We Built Q.Tap",[12,7112,7113],{},"Our journey began like many others in the observability space - with a proxy. We initially believed that intercepting and inspecting traffic through a man-in-the-middle approach was the only viable solution to gain visibility into traffic destined for service dependencies.",[12,7115,7116],{},"But as we engaged with the industry and listened to our users, a clear pattern emerged: while organizations desperately needed visibility into their encrypted traffic, they were frustrated with the operational overhead of managing certificates, configuring proxies, and maintaining yet another component in their already complex architectures.\nThe feedback was consistent:",[12,7118,7119],{},"\"Certificate management is a nightmare.\"",[12,7121,7122],{},"\"We need visibility, but we can't afford the latency impact.\"",[12,7124,7125],{},"\"Deploying proxies across our entire infrastructure is too resource-intensive.\"",[29,7127,7129],{"id":7128},"the-pivot-from-proxy-to-ebpf","The Pivot: From Proxy to eBPF",[12,7131,7132],{},"This feedback pushed us to rethink our approach fundamentally. What if we could provide the visibility teams needed without the proxy headache? What if we could tap into encrypted traffic before it even gets encrypted?",[12,7134,7135],{},"Enter Q.Tap - our OpenSSL-focused solution that leverages the power of eBPF to capture critical request\u002Fresponse details pre-encryption, directly from the kernel.",[12,7137,7138],{},"The key insight that drove our development was simple: we don't need to decrypt traffic if we can observe it before encryption occurs. By hooking into OpenSSL at the library level, Q.Tap provides all the visibility of a proxy with none of the operational overhead.",[29,7140,7142],{"id":7141},"cloud-complexity-encryption-hide-critical-security-information","Cloud Complexity & Encryption Hide Critical Security Information",[12,7144,7145],{},"Without the full picture, security teams are forced to rely on static, out-of-date, and often incomplete information about what's happening in their environments. This creates multiple critical blind spots:",[12,7147,7148],{},"Undocumented External Dependencies: We're identifying untracked shadow APIs and services that could lead to supply chain attacks or outages when compromised.",[12,7150,7151],{},"Sensitive Data Exfiltration: We're detecting when PII, credentials, or other sensitive data is being sent to unauthorized endpoints, indicating potential data leaks or misconfigured applications.",[12,7153,7154],{},"Misconfigured Egress Policies: We're highlighting overly permissive outbound traffic rules that allow connections to malicious domains, increasing the risk of data breaches.",[12,7156,7157],{},"Unauthorized API Access: We're identifying API calls using improper or compromised credentials, which could indicate credential stuffing or stolen keys.",[12,7159,7160],{},"Our customers were struggling with these challenges daily, and traditional solutions were falling short.",[29,7162,7164],{"id":7163},"how-qtap-works","How Q.Tap Works",[12,7166,7167],{},"Unlike traditional proxies that sit in the network path and require certificate management, Q.Tap works by:",[12,7169,7170],{},"Deploying a lightweight eBPF agent that attaches to OpenSSL calls",[12,7172,7173],{},"Capturing traffic before encryption occurs",[12,7175,7176],{},"Providing detailed visibility into requests and responses without affecting the encryption process",[12,7178,7179],{},"Requiring zero configuration changes to applications or network",[12,7181,7182],{},[179,7183],{"alt":7184,"src":7185},"Qtap How It Works@2x 8","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.04.29.security.observability\u002F4e7e73b8-f0c8-4624-af81-84678e179319.png",[12,7187,7188],{},"The result? Complete visibility into encrypted traffic without the need to manage certificates, configure proxies, or modify application code.",[29,7190,7192],{"id":7191},"the-qpoint-security-solution-zero-instrumentation","The Qpoint Security Solution: Zero Instrumentation",[12,7194,7195],{},"Q.Tap delivers five key capabilities that transform security observability:",[12,7197,7198],{},"See Through Encrypted Traffic: We capture critical request\u002Fresponse details pre-encryption—no TLS termination or certificate management required. This means you can finally see what's in those encrypted payloads without compromising your security model.",[12,7200,7201],{},"Automatically Discover Dependencies & External Integrations: We map all dependencies and external connections, with full attribution to show what's connecting and which teams own them. No more surprise integrations or shadow IT.",[12,7203,7204],{},"Identify PII & Sensitive Data Sharing: We verify that sensitive data (like PII or financial information) isn't being inadvertently transmitted, helping meet regulatory requirements like GDPR or PCI-DSS.",[12,7206,7207],{},"Realtime Alerts When Anything Changes: Don't wait to be told about new vendors, integrations, or sensitive data exfiltration routes. Get realtime alerts whenever anything changes in your environment.",[12,7209,7210],{},"Enforce Safe Egress Controls: Implement granular egress control policies directly at the source, safeguarding AI workloads and data exfiltration routes.",[29,7212,7213],{"id":184},[179,7214],{"alt":7215,"src":7216},"Q.plane@2x 8","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.04.29.security.observability\u002F2d20a6cd-759e-4155-9e53-c64b43480bbe.png",[29,7218,7220],{"id":7219},"why-open-source","Why Open Source?",[12,7222,7223],{},"We've decided to release Q.Tap as an open-source solution for the OpenSSL library because we believe that basic visibility into encrypted traffic shouldn't be a luxury - it should be accessible to everyone. Our commercial offerings will extend support to other TLS implementations (GoTLS, NodeTLS, JavaSSL) while providing additional enterprise features.",[29,7225,7227],{"id":7226},"beyond-qtap-the-qpoint-platform","Beyond Q.Tap: The Qpoint Platform",[12,7229,7230],{},"While Q.Tap solves the immediate challenge of encrypted traffic visibility, it's just one component of our broader Qpoint platform, which addresses the full spectrum of service dependency challenges:",[237,7232,7233,7236,7239,7242],{},[240,7234,7235],{},"Discovering and mapping dependencies across your entire ecosystem",[240,7237,7238],{},"Resolving issues 10-20x faster with precise attribution and unified visibility",[240,7240,7241],{},"Enforcing granular access control policies directly at the source",[240,7243,7244],{},"Safeguarding AI workloads with real-time governance",[29,7246,7248],{"id":7247},"get-started-today","Get Started Today",[12,7250,7251,7252,7255],{},"Ready to try Q.Tap? Visit our GitHub repository at  ",[731,7253,5496],{"href":5496,"rel":7254},[735]," to download, install, and start gaining visibility into your encrypted traffic within minutes.",[12,7257,7258],{},"Join us on this journey to make service dependencies visible, controllable, and secure - without the proxy headache.",[12,7260,7261],{},"Qpoint: Security Observability for the Encrypted Cloud - No Proxies, No Code Changes, Simple Installation",{"title":184,"searchDepth":185,"depth":185,"links":7263},[7264,7265,7266,7267,7268,7269,7270,7271,7272],{"id":7109,"depth":185,"text":7110},{"id":7128,"depth":185,"text":7129},{"id":7141,"depth":185,"text":7142},{"id":7163,"depth":185,"text":7164},{"id":7191,"depth":185,"text":7192},{"id":184,"depth":185,"text":184},{"id":7219,"depth":185,"text":7220},{"id":7226,"depth":185,"text":7227},{"id":7247,"depth":185,"text":7248},"2025-04-29","See through encryption to secure complex production cloud applications","Unveiling Q.Tap Open Source","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.04.29.security.observability\u002Fq.tap@2x-8.png",{},"\u002Fblog\u002Fqtap-see-through-encryption",{"title":7096,"description":7274},"qtap-see-through-encryption","blog\u002Fqtap-see-through-encryption","See through encryption to secure your complex cloud environments","gDjNlGimWgCZwNOVM_fXJzRE8ZP2lLnoN-0VyDtAk9Q",{"id":7285,"title":7286,"author":7,"body":7287,"date":7467,"description":7468,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":7469,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":7470,"navigation":201,"path":7471,"seo":7472,"slug":7473,"stem":7474,"subHeadline":7475,"tags":197,"__hash__":7476},"blog\u002Fblog\u002Ftap-into-your-egress-traffic-with-ebpf.md","Tap Into Your External API Traffic with eBPF",{"type":9,"value":7288,"toc":7460},[7289,7292,7296,7299,7302,7305,7308,7312,7315,7321,7327,7333,7337,7341,7349,7353,7367,7371,7379,7383,7386,7390,7393,7396,7402,7406,7409,7412,7417,7422,7426,7429,7432,7437,7441,7444,7447,7452,7454,7457],[12,7290,7291],{},"In modern IT infrastructures, effectively managing and securing egress traffic — data that leaves an organization to external destinations — is crucial for both security and operational efficiency. Traditionally, IT teams have focused primarily on incoming traffic and internal network flows, often overlooking the critical importance of outbound data streams. This oversight can lead to vulnerabilities and operational blindspots.",[73,7293,7295],{"id":7294},"understanding-the-need-for-comprehensive-egress-observability","Understanding the Need for Comprehensive Egress Observability",[12,7297,7298],{},"From a security perspective, egress traffic is a critical vector for data exfiltration, where sensitive information can be silently siphoned off by malicious actors. Without proper observability, compromised systems within a network can communicate with external command and control servers, exacerbating security risks. The Log4J vulnerability crisis serves as a stark reminder of how attackers can exploit weaknesses to infiltrate networks and establish persistent threats.",[12,7300,7301],{},"Operationally, lack of visibility into outbound traffic can lead to inefficiencies, compliance issues, and degraded application performance. Many organizations struggle to maintain a clear picture of which applications are making external connections and to what endpoints. This can result in difficulties managing API usage, ensuring regulatory compliance, and quickly resolving issues with third-party services.",[12,7303,7304],{},"Moreover, as businesses increasingly rely on cloud services and APIs, the ability to monitor and manage egress traffic becomes paramount for maintaining system reliability and optimizing performance. Without proper tools, teams may face challenges in identifying the root causes of application issues, managing API token usage, or detecting potential service disruptions before they impact end-users.",[12,7306,7307],{},"The growing complexity of modern IT environments, coupled with stringent regulatory requirements and the ever-present threat of cyber attacks, underscores the necessity for robust, comprehensive egress traffic monitoring. Such capabilities are essential not just for strengthening security postures, but also for enhancing operational efficiency, ensuring compliance, and supporting rapid, data-driven decision making across IT operations.",[73,7309,7311],{"id":7310},"introducing-qtap","Introducing Qtap",[12,7313,7314],{},"Qtap employs eBPF to achieve high-fidelity application traffic inspection, offering deep visibility into outbound SSL\u002FTLS traffic before encryption. This allows for *full *payload access without the need for TLS termination or certificate management, giving organizations the ability to detect and respond to traffic anomalies in real-time. And, Qtap delivers on this value proposition with an attractive operational profile:",[12,7316,7317,7320],{},[155,7318,7319],{},"Built on eBPF:"," Qtap operates at the kernel level, enabling detailed and efficient traffic analysis with minimal system impact.",[12,7322,7323,7326],{},[155,7324,7325],{},"Easy to Deploy:"," Install Qtap with a single command as a docker container, linux binary, or Helm chart. Start with Qtap on a few hosts and scale across your infrastructure as needed.",[12,7328,7329,7332],{},[155,7330,7331],{},"Out-of-Band Execution:"," Qtap’s out-of-band traffic analysis ensures comprehensive monitoring without introducing latency, decryption overhead, or single points of failure.",[73,7334,7336],{"id":7335},"technical-advantages-of-qtap","Technical Advantages of Qtap",[1179,7338,7340],{"id":7339},"deep-visibility-into-https-traffic","Deep Visibility into HTTPS Traffic",[237,7342,7343],{},[240,7344,7345,7348],{},[155,7346,7347],{},"Pre-encryption and Post-decryption Data Capture:"," Capture detailed data insights from the full traffic payload before any encryption occurs and after decryption, ensuring no data detail is missed.",[1179,7350,7352],{"id":7351},"operational-simplicity","Operational Simplicity",[237,7354,7355,7361],{},[240,7356,7357,7360],{},[155,7358,7359],{},"No Modifications Required:"," Qtap does not require any changes to SSL\u002FTLS libraries or the applications that use them, ensuring that your existing security infrastructure remains intact.",[240,7362,7363,7366],{},[155,7364,7365],{},"No Need to Manage Certificates:"," Unlike traditional outbound proxies that require managing certificates for TLS termination and inspection, Qtap simplifies operations by eliminating the need for such management. This removes a significant administrative burden and complexity often associated with securing outbound traffic, especially in environments with stringent compliance requirements.",[1179,7368,7370],{"id":7369},"efficiency-and-performance","Efficiency and Performance",[237,7372,7373],{},[240,7374,7375,7378],{},[155,7376,7377],{},"Lightweight eBPF Probes:"," The use of lightweight eBPF probes minimizes the impact on system performance, making Qtap ideal for high-traffic environments.",[73,7380,7382],{"id":7381},"qtap-use-cases","Qtap Use Cases",[12,7384,7385],{},"Now that we've covered the technical aspects of Qtap, let's explore how it addresses common challenges in network management and security. The following scenarios illustrate Qtap's practical applications in various operational contexts.",[1179,7387,7389],{"id":7388},"layer-7-visibility","Layer 7 Visibility",[12,7391,7392],{},"Many operations teams struggle to maintain a clear picture of their network traffic, particularly regarding which applications are making external connections and to what endpoints. This lack of visibility can lead to security vulnerabilities and compliance issues.",[12,7394,7395],{},"Qtap addresses this challenge by creating a detailed map of all egress traffic. It provides a comprehensive view of network activity, allowing teams to identify unusual patterns or unexpected connections quickly. For instance, Qtap can detect when an application suddenly begins communicating with an unfamiliar server or when there's an unexpected surge in traffic to a particular endpoint. This level of insight enables proactive management of network resources and enhances overall security posture.",[12,7397,7398],{},[179,7399],{"alt":7400,"src":7401},"Tap in With Ebpf 1.png","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.08.01.tap.into\u002F95f52512-6297-4717-8121-7364b31d9ef4.png",[1179,7403,7405],{"id":7404},"real-time-monitoring-and-alerting","Real-Time Monitoring and Alerting",[12,7407,7408],{},"In the realm of network security, rapid response is crucial. Even minor delays in detecting and addressing issues can lead to significant consequences. Qtap serves as a silent observer, continuously monitoring traffic patterns and promptly alerting teams to potential problems.",[12,7410,7411],{},"Qtap provides context-rich information about anomalies, potential security breaches, and performance issues. This detailed insight allows teams to quickly assess situations and take appropriate action, significantly reducing response times and minimizing potential damage.",[12,7413,7414],{},[179,7415],{"alt":184,"src":7416},"\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.08.01.tap.into\u002Fd26e9727-1743-4e28-944c-ea237b015250.png",[12,7418,7419],{},[179,7420],{"alt":184,"src":7421},"\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.08.01.tap.into\u002F275aee43-7294-4cc7-a917-15e8771a6f1f.png",[1179,7423,7425],{"id":7424},"enhanced-third-party-api-reliability","Enhanced Third-Party API Reliability",[12,7427,7428],{},"In today's interconnected digital ecosystem, applications often rely heavily on third-party APIs. Any issues with these external services can have cascading effects on overall system performance. Qtap acts as an early warning system for API-related problems.",[12,7430,7431],{},"By monitoring traffic to third-party services, Qtap can alert teams to potential issues before they escalate into major disruptions. It can detect increases in API errors or latency, allowing teams to take preemptive action. This proactive approach to API management helps maintain system reliability and minimize downtime.",[12,7433,7434],{},[179,7435],{"alt":184,"src":7436},"\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.08.01.tap.into\u002F2f9d6de1-c33e-4633-bb33-009c58a43fb1.png",[1179,7438,7440],{"id":7439},"accelerated-development-and-debugging","Accelerated Development and Debugging",[12,7442,7443],{},"Debugging production issues can be a time-consuming and complex process for development teams. Qtap significantly simplifies this task by providing detailed, request-level data that developers can use to quickly identify and resolve issues.",[12,7445,7446],{},"With Qtap, developers gain unprecedented visibility into application traffic, allowing them to pinpoint the source of problems more efficiently. This capability not only speeds up the debugging process but also enables developers to focus more of their time on feature development and innovation.",[12,7448,7449],{},[179,7450],{"alt":184,"src":7451},"\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.08.01.tap.into\u002Fa2c5a1c4-b1ee-4e39-b3ae-50c83762f531.png",[73,7453,4834],{"id":4833},[12,7455,7456],{},"In the current digital environment, effective management and security of egress traffic is essential for organizational cybersecurity. Qtap provides a robust solution to the challenge of egress observability, overcoming the limitations of conventional methods.",[12,7458,7459],{},"Qtap's use of eBPF technology enables detailed visibility into SSL\u002FTLS traffic without requiring TLS termination or certificate management. This approach, coupled with straightforward deployment and low performance overhead, makes Qtap a significant advancement in network security and management.",{"title":184,"searchDepth":185,"depth":185,"links":7461},[7462,7463,7464,7465,7466],{"id":7294,"depth":191,"text":7295},{"id":7310,"depth":191,"text":7311},{"id":7335,"depth":191,"text":7336},{"id":7381,"depth":191,"text":7382},{"id":4833,"depth":191,"text":4834},"2024-08-01","Qpoint taps into connections at the source, enabling you to see through encryption, map your dependencies, and enforce egress controls","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.08.01.tap.into\u002Fhero@2x.png",{},"\u002Fblog\u002Ftap-into-your-egress-traffic-with-ebpf",{"title":7286,"description":7468},"tap-into-your-egress-traffic-with-ebpf","blog\u002Ftap-into-your-egress-traffic-with-ebpf","Explore how Qtap leverages eBPF to provide deep visibility and real-time monitoring of outbound data flows to enhance the resilience and security of your production applications and cloud environments.","eUxlRlWvXxz7HlpXy_YmHPLatRnggAgjo-zDSElt0tk",{"id":7478,"title":7479,"author":7,"body":7480,"date":7722,"description":7723,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":7724,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":201,"listingImage":7725,"logoColor":197,"maxImgWidth":197,"meta":7726,"navigation":201,"path":7727,"seo":7728,"slug":7729,"stem":7730,"subHeadline":7731,"tags":197,"__hash__":7732},"blog\u002Fblog\u002Fthe-cisos-checklist-what-your-current-tools-cant-tell-you.md","The CISO's Checklist - What Your Current Tools Can't Tell You",{"type":9,"value":7481,"toc":7713},[7482,7488,7491,7494,7511,7517,7520,7526,7532,7538,7541,7546,7551,7554,7559,7564,7567,7572,7577,7580,7585,7590,7596,7602,7606,7612,7615,7618,7621,7624,7627,7630,7633,7636,7639,7642,7645,7648,7665,7668,7674,7700,7704,7707,7710],[29,7483,7485],{"id":7484},"the-visibility-gap-where-traditional-tools-fall-short",[155,7486,7487],{},"The Visibility Gap: Where Traditional Tools Fall Short",[12,7489,7490],{},"Modern enterprises operate in a world where 95% of network traffic is encrypted. While this protects data in transit, it also creates massive blind spots for security teams. Your current tools operate at the wrong vantage points, missing crucial context about what's actually flowing through your systems.",[12,7492,7493],{},"Traditional monitoring approaches fail because they:",[237,7495,7496,7499,7502,7505,7508],{},[240,7497,7498],{},"See traffic only after encryption has occurred",[240,7500,7501],{},"Lack process-level attribution for connections",[240,7503,7504],{},"Miss the actual data payload being transmitted",[240,7506,7507],{},"Cannot identify which specific services are communicating",[240,7509,7510],{},"Require complex certificate management or proxies that break in production",[29,7512,7514],{"id":7513},"the-cisos-critical-visibility-checklist",[155,7515,7516],{},"The CISO's Critical Visibility Checklist",[12,7518,7519],{},"Here are the questions keeping security leaders awake at night, and why current tools can't answer them:",[7521,7522],"heading-icon",{":level":7523,"icon":7524,"text":7525},"3","checkbox-fat","What sensitive data is leaving our environment right now?",[12,7527,7528,7531],{},[155,7529,7530],{},"What Current Tools Miss:"," Encrypted traffic masks payload content. Your firewall sees an HTTPS connection to a third-party API, but has no idea if it contains customer PII, source code, or API keys.",[12,7533,7534,7537],{},[155,7535,7536],{},"The Hidden Risk:"," Without payload visibility, you're flying blind. That innocent-looking connection to a analytics service might be leaking customer data. The AI assistant your developers integrated last week could be sending proprietary algorithms to train public models.",[7521,7539],{":level":7523,"icon":7524,"text":7540},"Which third-party services are we actually connected to?",[12,7542,7543,7545],{},[155,7544,7530],{}," Service meshes and API gateways only see traffic they proxy. Direct connections from applications, background jobs, and CI\u002FCD pipelines remain invisible. Shadow IT thrives in these gaps.",[12,7547,7548,7550],{},[155,7549,7536],{}," Security questionnaires claim you connect to 50 vendors. Reality? Most organizations discover 3-4x more connections when they gain true visibility. Each unknown connection represents unassessed risk.",[7521,7552],{":level":7523,"icon":7524,"text":7553},"Can we prove PII isn't leaving our EU data center?",[12,7555,7556,7558],{},[155,7557,7530],{}," Network monitoring shows traffic flows between regions, but can't prove what data those flows contain. Log aggregation misses ephemeral connections and can't inspect encrypted payloads.",[12,7560,7561,7563],{},[155,7562,7536],{}," Failed audits, GDPR violations, and loss of customer trust. When auditors ask for proof of data residency, IP addresses and network flows aren't enough. You need to show what data actually moved.",[7521,7565],{":level":7523,"icon":7524,"text":7566},"If a vendor announces a breach, what's our exposure?",[12,7568,7569,7571],{},[155,7570,7530],{}," Traditional tools can tell you if you connect to a vendor, but not what you send them. Incident response becomes a weeks-long archaeology project through logs and code.",[12,7573,7574,7576],{},[155,7575,7536],{}," Every vendor breach triggers the same scramble: emergency meetings, manual code reviews, and guesswork about exposure. Meanwhile, your data might already be compromised.",[7521,7578],{":level":7523,"icon":7524,"text":7579},"What are our AI tools sending to external models?",[12,7581,7582,7584],{},[155,7583,7530],{}," AI API calls look like any other HTTPS traffic. Your security tools can't distinguish between a benign query and one containing customer data or intellectual property.",[12,7586,7587,7589],{},[155,7588,7536],{}," AI adoption is exploding, often without security oversight. Developers send production data to AI services for debugging. Support teams paste customer information into chatbots. Your crown jewels could be training someone else's model.",[29,7591,7593],{"id":7592},"filling-the-gaps-what-true-visibility-looks-like",[155,7594,7595],{},"Filling the Gaps: What True Visibility Looks Like",[12,7597,7598,7599],{},"The solution requires a fundamental shift in approach. Instead of trying to inspect traffic after encryption or requiring architectural changes, modern security demands visibility at the source, where connections originate.\n",[179,7600],{"src":7601,"alt":3289,"style":3290},"\u002Fimages\u002F2025.Q3\u002F2025.10.28.CISO.bomb4.jpg",[73,7603,7605],{"id":7604},"effective-data-in-motion-security-provides","Effective data-in-motion security provides:",[7521,7607],{":level":7523,"icon":7608,"text":7609,":iconMarginTop":7610,"iconColor":7611},"check-fat","Process-Level Attribution","7","#05af6b",[12,7613,7614],{},"Every connection traced back to its originating process, container, and pod. You know not just that traffic is flowing, but exactly which service initiated it.",[7521,7616],{":level":7523,"icon":7608,"text":7617,":iconMarginTop":7610,"iconColor":7611},"Pre-Encryption Visibility",[12,7619,7620],{},"By observing traffic at the kernel level before TLS encryption, you see actual payloads, headers, and metadata without breaking security models or managing certificates.",[7521,7622],{":level":7523,"icon":7608,"text":7623,":iconMarginTop":7610,"iconColor":7611},"Automatic Discovery",[12,7625,7626],{},"No manual configuration or traffic routing. Every connection is automatically discovered and classified, including those your current tools miss entirely.",[7521,7628],{":level":7523,"icon":7608,"text":7629,":iconMarginTop":7610,"iconColor":7611},"Real-Time Classification",[12,7631,7632],{},"Machine learning models identify sensitive data patterns (PII, PCI, credentials) as traffic flows, turning raw connections into risk-scored intelligence.",[7521,7634],{":level":7523,"icon":7608,"text":7635,":iconMarginTop":7610,"iconColor":7611},"Zero Production Impact",[12,7637,7638],{},"eBPF technology operates out-of-band, ensuring zero latency impact and no architectural changes. Install in minutes, not months.",[7521,7640],{":level":7523,"icon":7608,"text":7641,":iconMarginTop":7610,"iconColor":7611},"From Blind Spots to Complete Visibility",[12,7643,7644],{},"Qpoint addresses these critical gaps by providing powerful visibility into all encrypted traffic originating from your backend infrastructure. Unlike proxies or traditional monitoring that create bottlenecks and miss connections, Qpoint operates at the source of truth: the Linux kernel itself.",[12,7646,7647],{},"Within minutes of deployment, security teams gain:",[237,7649,7650,7653,7656,7659,7662],{},[240,7651,7652],{},"A complete inventory of every external connection",[240,7654,7655],{},"Classification of sensitive data in transit",[240,7657,7658],{},"Definitive evidence for compliance audits",[240,7660,7661],{},"Instant answers during vendor breaches",[240,7663,7664],{},"Full visibility into AI service communications",[12,7666,7667],{},"The result? You transform from reactive to proactive security. Instead of discovering risks after breaches, you identify and remediate them continuously.",[29,7669,7671],{"id":7670},"taking-action-your-next-steps",[155,7672,7673],{},"Taking Action: Your Next Steps",[267,7675,7676,7682,7688,7694],{},[240,7677,7678,7681],{},[155,7679,7680],{},"Audit Your Current Visibility:"," Run through the checklist above. How many questions can your current tools definitively answer?",[240,7683,7684,7687],{},[155,7685,7686],{},"Identify Critical Gaps:"," Focus on your highest-risk blind spots. Are you heavily invested in AI? Do you operate in regulated industries? Is third-party risk a board-level concern?",[240,7689,7690,7693],{},[155,7691,7692],{},"Demand Better Visibility:"," Stop accepting \"we can't see encrypted traffic\" as an answer. Modern approaches like Qpoint prove that comprehensive visibility is possible without compromising security or performance.",[240,7695,7696,7699],{},[155,7697,7698],{},"Start Small, Think Big:"," Begin with a proof of concept on critical systems. Most organizations discover unknown risks within the first hour of deployment.",[29,7701,7702],{"id":4833},[155,7703,4834],{},[12,7705,7706],{},"The questions on this checklist aren't going away. Boards want answers. Auditors demand proof. Attackers exploit blind spots. The gap between what your current tools can tell you and what you need to know grows wider every day.",[12,7708,7709],{},"True security requires seeing everything: every connection, every payload, every risk. When encryption no longer blinds you, you can finally answer the hard questions with confidence.",[12,7711,7712],{},"The choice is clear: continue operating with dangerous blind spots, or gain the visibility modern security demands. Your data is already in motion. The question is whether you can see where it's going.",{"title":184,"searchDepth":185,"depth":185,"links":7714},[7715,7716,7717,7720,7721],{"id":7484,"depth":185,"text":7487},{"id":7513,"depth":185,"text":7516},{"id":7592,"depth":185,"text":7595,"children":7718},[7719],{"id":7604,"depth":191,"text":7605},{"id":7670,"depth":185,"text":7673},{"id":4833,"depth":185,"text":4834},"2025-10-30","As a CISO, you've invested heavily in security tools. Yet when the board asks about your organization's true risk exposure, you still face uncomfortable silence around critical questions. The problem lies in what encryption hides from your existing security stack.","\u002Fimages\u002F2025.Q3\u002F2025.10.28.CISO.checklist.jpg","\u002Fimages\u002F2025.Q4\u002F2025.10.28.CISO.listing-horizontal.3.jpg",{},"\u002Fblog\u002Fthe-cisos-checklist-what-your-current-tools-cant-tell-you",{"title":7479,"description":7723},"the-cisos-checklist-what-your-current-tools-cant-tell-you","blog\u002Fthe-cisos-checklist-what-your-current-tools-cant-tell-you","The visibility gap where traditional security tools fall short and what true visibility looks like","MfGuGjHBE33wFMjxmGCDM3OlvWtwNPaECVAR12KQA7s",{"id":7734,"title":7735,"author":7,"body":7736,"date":7921,"description":7740,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":7922,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":7923,"logoColor":197,"maxImgWidth":197,"meta":7924,"navigation":201,"path":7925,"seo":7926,"slug":7927,"stem":7928,"subHeadline":7740,"tags":197,"__hash__":7929},"blog\u002Fblog\u002Fthe-encryption-paradox.md","The Encryption Paradox",{"type":9,"value":7737,"toc":7913},[7738,7741,7744,7748,7751,7762,7765,7771,7775,7784,7787,7790,7793,7797,7804,7807,7827,7830,7834,7837,7840,7843,7847,7850,7874,7877,7880,7884,7887,7890,7893,7895,7903],[12,7739,7740],{},"Every security incident post-mortem reveals the same pattern: the evidence was there in the network traffic all along. The warning signs existed, but they were hidden beneath layers of encryption and distributed across dozens of services.",[12,7742,7743],{},"Most security teams today have sophisticated toolsets—vulnerability scanners, SIEM platforms, compliance frameworks. Yet there's a fundamental gap in our visibility. We can see that connections are being made, but not what's being transmitted. We know services are talking, but not what they're saying. This isn't a failure of security teams; it's a limitation of our current tools.",[29,7745,7747],{"id":7746},"the-network-traffic-blind-spot","The Network Traffic Blind Spot",[12,7749,7750],{},"Consider your current security posture. You can likely track application logs, scan for known vulnerabilities, and monitor system runtime behavior. But can you answer these fundamental questions right now?",[237,7752,7753,7756,7759],{},[240,7754,7755],{},"Which third-party SDKs are \"phoning home,\" and what information are they sending?",[240,7757,7758],{},"Which of your services are sending customer data to an external AI platform?",[240,7760,7761],{},"What specific API keys are being transmitted in your production environment?",[12,7763,7764],{},"Many of these questions remain unanswered because HTTPS encryption—the very technology we rely on for security—has created a massive visibility gap. We've secured the channel so well that we've lost sight of what's flowing through it. Modern applications make hundreds of API calls to dozens of external services, and security teams have essentially no idea what data is being exchanged. We've encrypted ourselves into ignorance.",[12,7766,7767,7768,7770],{},"This is the problem ",[731,7769,3329],{"href":1631}," is designed to solve; it allows you to see system-wide traffic before it's encrypted. To do so, it requires privileged access—root permissions and low-level hooks. These capabilities provide visibility into a class of vulnerabilities that are otherwise undetectable.",[29,7772,7774],{"id":7773},"how-it-works-the-role-of-ebpf","How It Works: The Role of eBPF",[12,7776,7777,7778,7783],{},"The technology that makes this possible is ",[155,7779,7780],{},[731,7781,1439],{"href":7782},"\u002Fblog\u002Fwhat-is-ebpf",", a significant development in systems engineering. Unlike traditional kernel modules that could risk system stability, eBPF programs are subjected to a rigorous verification process by the Linux kernel itself before they are allowed to run.",[12,7785,7786],{},"This safety guarantee matters. The kernel's verifier performs exhaustive analysis of every possible execution path. It checks memory access, prevents infinite loops, and ensures bounded execution time. Companies like Netflix, Facebook, and Google run eBPF programs in production at massive scale. Cloudflare uses eBPF for DDoS protection. Cilium uses it for container networking. These are battle-tested technologies powering some of the internet's most critical services.",[12,7788,7789],{},"eBPF solves the safety problem that native kernel modules face. While a native module can crash the kernel with a single null pointer dereference, an eBPF program would not even be able to load. The verifier is both the safety net and the single most painful part of developing eBPF programs. The verifier will simply not allow mistakes, even if potential and not actual.",[12,7791,7792],{},"When Brendan Gregg, arguably one of the world's foremost experts on systems performance, says that eBPF \"makes this easy but does not make it possible,\" he's highlighting a crucial point. The same visibility Qtap provides could be achieved with debuggers, network taps, or custom instrumentation—but those approaches are fragile, performance-impacting, and difficult to deploy. eBPF makes this visibility practical and safe at production scale.",[29,7794,7796],{"id":7795},"data-control-and-architectural-simplicity","Data Control and Architectural Simplicity",[12,7798,7799,7800,7803],{},"While Qtap requires privileged access to inspect traffic, ",[155,7801,7802],{},"you retain complete control over your data",". Sensitive payloads never need to leave your network boundary. You can keep the data local, direct it to your own cloud storage, or pipe it to your preferred logging tools. You own your data.",[12,7805,7806],{},"This approach offers a clear advantage over alternatives:",[237,7808,7809,7815,7821],{},[240,7810,7811,7814],{},[155,7812,7813],{},"MITM (Man-in-the-Middle) Proxies"," require complex certificate management and create potential single points of failure.",[240,7816,7817,7820],{},[155,7818,7819],{},"Traditional APM Tools"," often run with similar privileges but typically require sending your data to a vendor's cloud for processing.",[240,7822,7823,7826],{},[155,7824,7825],{},"Network Taps"," only see encrypted streams unless you implement SSL termination, which introduces its own operational overhead and security considerations.",[12,7828,7829],{},"By hooking directly into TLS libraries at the source, Qtap provides the clearest visibility with the least architectural disruption.",[29,7831,7833],{"id":7832},"the-security-impact","The Security Impact",[12,7835,7836],{},"When many customers deploy Qtap, they aren't looking for security issues—they are trying to debug API latency. But within days, they discover hardcoded API keys that've been in production for years, authentication tokens being logged to third-party services, and customer PII flowing to vendors they didn't even remember integrating. These companies have good security practices and competent teams. These issues were invisible because the tooling to see them didn't exist.",[12,7838,7839],{},"This pattern repeats everywhere Qtap is deployed. Teams discover shadow IT integrations, deprecated services still receiving production data, overprivileged API keys, and sensitive data flowing to unexpected destinations. One financial services company found they were sending full credit card numbers to a marketing analytics service—not maliciously, but because a developer had included the wrong field in an event payload three years ago. Without Qtap, this would have continued indefinitely.",[12,7841,7842],{},"Every security professional knows these problems exist. Now we have a practical way to find and fix them.",[29,7844,7846],{"id":7845},"the-fear-factor","The Fear Factor",[12,7848,7849],{},"The idea of installing a tool with root permissions naturally raises security questions. That caution is a critical part of maintaining a secure infrastructure. Qtap is designed to address these concerns through transparent, verifiable safeguards:",[237,7851,7852,7858,7865],{},[240,7853,7854,7855,7857],{},"It's ",[155,7856,328],{},", allowing for complete code inspection.",[240,7859,7860,7861,7864],{},"It runs in a ",[155,7862,7863],{},"kernel-verified eBPF sandbox"," to protect system integrity.",[240,7866,7867,7870,7871,221],{},[155,7868,7869],{},"You retain full control of your data",", which never has to leave your ",[155,7872,7873],{},"network boundary",[12,7875,7876],{},"These principles provide the trust necessary to focus on the more pressing issue: the unknown vulnerabilities, like exposed API keys and data leaks, currently active inside your encrypted traffic.",[12,7878,7879],{},"Teams that deploy Qtap consistently report a shift in perspective. The initial, healthy caution around the tool's access soon evolves. After seeing the reality of their production traffic, they find that operating without that visibility becomes the greater concern. Going back to a state of blindness is no longer a comfortable option.",[29,7881,7883],{"id":7882},"the-future-of-security-observability","The Future of Security Observability",[12,7885,7886],{},"Within five years, payload-level network observability will be table stakes for security teams, just like log aggregation is today. Organizations that adopt this capability now will have a massive advantage—in security, compliance, cost optimization, and operational efficiency. They'll answer auditor questions with actual data instead of assertions. They'll catch breaches before they become incidents. They'll optimize API costs and eliminate redundant services.",[12,7888,7889],{},"The cautious approach is the right one. Start in a development environment. Build comfort with the technology. But don't let the fear of what you might find keep you in the dark.",[12,7891,7892],{},"The most dangerous vulnerabilities are the ones you can't see. They live in your API integrations and third-party dependencies, hidden by encryption. Qtap requires significant privileges because the problems it solves demand significant visibility.",[16,7894],{},[12,7896,7897],{},[250,7898,7899,7900,7902],{},"Ready to see what you've been missing? ",[731,7901,3387],{"href":1311}," with a Qpoint solution engineer and discover what's actually happening in your infrastructure.",[12,7904,7905],{},[250,7906,7907,7908,7912],{},"For more insights on security, compliance, and network visibility, explore our ",[731,7909,7911],{"href":7910},"\u002Fblog","blog"," for the latest thought leadership from the Qpoint team.",{"title":184,"searchDepth":185,"depth":185,"links":7914},[7915,7916,7917,7918,7919,7920],{"id":7746,"depth":185,"text":7747},{"id":7773,"depth":185,"text":7774},{"id":7795,"depth":185,"text":7796},{"id":7832,"depth":185,"text":7833},{"id":7845,"depth":185,"text":7846},{"id":7882,"depth":185,"text":7883},"2025-09-09","\u002Fimages\u002F2025.Q3\u002F2025.09.11.encryption.paradox.v.3.png","\u002Fimages\u002F2025.Q3\u002F2025.09.11.encryption.paradox.small.pattern.3.png",{},"\u002Fblog\u002Fthe-encryption-paradox",{"title":7735,"description":7740},"the-encryption-paradox","blog\u002Fthe-encryption-paradox","IB-hLWus2_efXNDetUbxxxH3z_jTNjwVG1WBClZ2n1E",{"id":7931,"title":7932,"author":5565,"body":7933,"date":8239,"description":8240,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":8241,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":8242,"navigation":201,"path":8243,"seo":8244,"slug":7938,"stem":8245,"subHeadline":8246,"tags":197,"__hash__":8247},"blog\u002Fblog\u002Fthe-hidden-risks-of-third-party-api-dependencies.md","The Hidden Risks of Third-Party API Dependencies",{"type":9,"value":7934,"toc":8229},[7935,7939,7942,7944,7948,7955,7961,7965,7968,7979,7981,7984,7990,7996,8002,8010,8014,8017,8024,8026,8032,8038,8044,8046,8052,8056,8059,8062,8064,8070,8076,8082,8084,8092,8096,8103,8106,8108,8114,8120,8126,8128,8134,8138,8141,8144,8146,8152,8158,8164,8166,8174,8178,8181,8184,8186,8192,8197,8202,8208,8210,8214,8217],[7936,7937,7932],"h1",{"id":7938},"the-hidden-risks-of-third-party-api-dependencies",[12,7940,7941],{},"The rapid shift to cloud-based infrastructure and services over the last decade has completely transformed how production applications are built and deployed. Today’s modern platforms rely on a growing web of third-party APIs to enable essential functions like payments, analytics, authentication, and many others. These integrations deliver incredible value and speed up time to market for new features, but they also bring unique risks and challenges that can disrupt operations, drive up costs, and jeopardize compliance.",[16,7943],{},[29,7945,7947],{"id":7946},"what-are-third-party-apis","What Are Third-Party APIs?",[12,7949,7950,7951,7954],{},"The term \"third-party API\" refers to the interface that an external SaaS provider makes available to developers to access the functionality and data offered by their service. Think of APIs for payments, analytics, or cloud services—which are not developed in-house but are critical to your platform’s success. Unlike first-party APIs, which a company develops internally, third-party APIs are managed and",[731,7952,7953],{"href":6279}," controlled by external vendors",". The lack of direct control over these endpoints introduces challenges like limited visibility, unpredictability, reliability impacts, and increased security risks.",[12,7956,7957,7958,221],{},"The following sections explore the key risks associated with third-party APIs and ",[731,7959,7960],{"href":7088},"how Qpoint can help",[29,7962,7964],{"id":7963},"third-party-api-observability-gap","Third-Party API Observability Gap",[12,7966,7967],{},"Most teams simply don’t understand the full scope of their third-party API dependencies. Hidden connections to unknown endpoints or undocumented integrations lead to blind spots for operators. These gaps make it difficult to monitor what data is leaving your environment and which vendors your applications depend on.",[12,7969,7970,7971,7973,7974,7978],{},"Qpoint leverages ",[731,7972,7010],{"href":7782}," to automatically discover and catalog all third-party connections with zero impact to dev teams. With real-time monitoring of traffic (including the payloads), you can finally see what’s happening across your third-party API ",[731,7975,7977],{"href":7976},"\u002Fblog\u002Funcovering-the-hidden-footprint-of-your-third-party-api-integrations","footprint"," and address risks before they escalate.",[16,7980],{},[12,7982,7983],{},"How Qpoint provides value:",[12,7985,7986,7989],{},[155,7987,7988],{},"Discovery & Cataloging:"," Automatic creation of a real-time inventory of all third-party API integrations",[12,7991,7992,7995],{},[155,7993,7994],{},"Real-Time Monitoring:"," Full visibility into external traffic, including headers and payload metadata.",[12,7997,7998,8001],{},[155,7999,8000],{},"Proactive Insights:"," Highlight unexpected or redundant connections to help optimize and reduce risks.",[12,8003,8004,8005,8009],{},"**",[179,8006],{"alt":8007,"src":8008},"Observability Gap","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.12.16.the.hidden\u002F316ffb1f-4cd4-4a44-b6b2-bce4e2e40c37.png"," **",[29,8011,8013],{"id":8012},"api-performance-and-reliability-risks","API Performance and Reliability Risks",[12,8015,8016],{},"Third-party APIs can fail, and when they do, the impact can ripple through your production applications. Outages, rate limits, and intermittent failures degrade user experience and complicate troubleshooting. Without detailed insights, resolving these issues can take hours—or worse, you might not realize there’s a problem until users complain.",[12,8018,8019,8023],{},[731,8020,8022],{"href":8021},"\u002Fblog\u002Fwhats-the-difference-between-my-apm-tool-and-qpoint","Qpoint monitors external APIs"," in real time, alerting you to errors, slowdowns, or rate-limit risks before they cause major disruptions. Detailed logs help you pinpoint the root cause quickly, to minimize downtime and improving reliability.",[12,8025,7983],{},[12,8027,8028,8031],{},[155,8029,8030],{},"Error Detection & Alerting:"," Monitor for and notify teams of API errors or anomalies in real time.",[12,8033,8034,8037],{},[155,8035,8036],{},"Rate-Limit Monitoring:"," Track usage patterns against API thresholds, alerting before limits are reached.",[12,8039,8040,8043],{},[155,8041,8042],{},"Root Cause Analysis:"," Provide detailed logs and insights to troubleshoot external service failures faster.",[16,8045],{},[12,8047,8048],{},[179,8049],{"alt":8050,"src":8051},"Reliability","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.12.16.the.hidden\u002Fe8ded9a5-7f44-4104-aadd-becf18809460.png",[29,8053,8055],{"id":8054},"unnecessary-or-hidden-costs","Unnecessary or Hidden Costs",[12,8057,8058],{},"Third-party APIs don’t just cost money to use—they can quietly drive up expenses without you noticing. Inefficient traffic patterns, redundant services, or excessive polling inflate bandwidth usage and cloud costs.",[12,8060,8061],{},"Qpoint provides granular usage metrics, helping you track consumption across both third-party APIs and your own applications. By optimizing redundant traffic and aligning usage with business priorities, you can reduce unnecessary spending and improve cost efficiency.",[12,8063,7983],{},[12,8065,8066,8069],{},[155,8067,8068],{},"Usage Metrics:"," Provide granular data on API consumption by API, application, or team.",[12,8071,8072,8075],{},[155,8073,8074],{},"Cost Attribution:"," Help allocate API and bandwidth costs to specific business units or projects.",[12,8077,8078,8081],{},[155,8079,8080],{},"Traffic Optimization:"," Identify redundant or chatty API calls to streamline interactions and reduce expenses.",[16,8083],{},[12,8085,8086],{},[155,8087,8088],{},[179,8089],{"alt":8090,"src":8091},"Hidden Costs","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.12.16.the.hidden\u002Ff607c566-f4c7-43b4-a288-c36312b7972d.png",[29,8093,8095],{"id":8094},"sensitive-data-exposure-and-compliance-risks","Sensitive Data Exposure and Compliance Risks",[12,8097,8098,8099,8102],{},"API interactions often handle sensitive data, but without proper oversight that data can be inadvertently exposed to the wrong vendors, creating security risks and ",[731,8100,8101],{"href":6523},"potential regulatory violations",". Compromised API tokens or misconfigured integrations can also lead to unauthorized access or data breaches.",[12,8104,8105],{},"Qpoint helps teams detect and address these risks by monitoring for sensitive data in transit and maintaining detailed audit logs of every API interaction. Qpoint enables a team to catalog sensitive data by application and endpoint,  track API token usage, and ensure compliance with regulations like GDPR or HIPAA.",[12,8107,7983],{},[12,8109,8110,8113],{},[155,8111,8112],{},"Sensitive Data Mapping:"," Detect and alert on sensitive data flowing through external traffic.",[12,8115,8116,8119],{},[155,8117,8118],{},"Audit Trails:"," Maintain logs of every interaction with external APIs for compliance and reporting.",[12,8121,8122,8125],{},[155,8123,8124],{},"API Token Visibility:"," Track API token usage to ensure proper access levels, detect anomalies, and mitigate potential abuse.",[16,8127],{},[12,8129,8130],{},[179,8131],{"alt":8132,"src":8133},"Sensitive Data","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.12.16.the.hidden\u002Fcb5c671a-cefa-44d8-9cb3-3dc4c777d66c.png",[29,8135,8137],{"id":8136},"operational-inefficiencies","Operational Inefficiencies",[12,8139,8140],{},"When an issue arises with a third-party API, debugging is often slowed by siloed tools and manual workflows. Teams waste time chasing incomplete data which delays incident response and impacts platform performance.",[12,8142,8143],{},"Qpoint streamlines operations by consolidating third-party API monitoring, error tracking, and logging in one platform. Actionable insights and real-time alerts reduce response times, while detailed logs simplify troubleshooting, enabling developers to spend more time building features and less searching for problems.",[12,8145,7983],{},[12,8147,8148,8151],{},[155,8149,8150],{},"Centralized Insights:"," Consolidates external API monitoring, error tracking, and cost attribution for efficient operations.",[12,8153,8154,8157],{},[155,8155,8156],{},"Proactive Notifications:"," Real-time alerts with actionable details reduce response times and prevent cascading failures.",[12,8159,8160,8163],{},[155,8161,8162],{},"Detailed Audit Logs:"," Captures complete records of API interactions to aid in troubleshooting and compliance.",[16,8165],{},[12,8167,8168],{},[155,8169,8170],{},[179,8171],{"alt":8172,"src":8173},"Operational Inefficiency","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.12.16.the.hidden\u002Fceed3b72-a28c-4183-81d0-0af4c7ac3201.png",[29,8175,8177],{"id":8176},"blind-spots-in-customer-driven-api-traffic","Blind Spots in Customer-Driven API Traffic",[12,8179,8180],{},"Heavy platform usage by your customers often translates into increased third-party API activity, which can result in hidden costs, performance bottlenecks, or rate-limit breaches in the absence of proper tracking and context. Worse, when an API error impacts customer experience, it can be difficult to trace and resolve.",[12,8182,8183],{},"Qpoint enables a team to map third-party API activity directly to customer interactions, providing the visibility you need to manage high-usage customers and prevent disruptions. Cost attribution by customer segment helps with budgeting, and proactive alerts ensure that your platform stays ahead of risks from third-party outages or throttling from rate limits.",[12,8185,7983],{},[12,8187,8188,8191],{},[155,8189,8190],{},"Customer-Centric Tracking:"," Maps external API interactions directly to customer activity for granular visibility.",[12,8193,8194,8196],{},[155,8195,8162],{}," Links third-party API errors to individual customers, enabling faster issue resolution.",[12,8198,8199,8201],{},[155,8200,8074],{}," Tracks API consumption per customer to support resource optimization and budgeting.",[12,8203,8204,8207],{},[155,8205,8206],{},"Real-Time Monitoring & Alerting:"," Notifies teams when customer-driven API usage risks rate limits or service disruptions.",[16,8209],{},[29,8211,8213],{"id":8212},"take-control-of-your-third-party-dependencies","Take Control of Your Third-Party Dependencies",[12,8215,8216],{},"Third-party APIs are the backbone of modern platforms, enabling essential functionality and faster innovation. However, the risks that are introduced—hidden dependencies, unexpected costs, performance disruptions, and compliance challenges—should not be ignored. Qpoint empowers your team with real-time visibility, actionable insights, and granular control over your third-party integrations to enable proactive management of these critical dependencies, ensuring that your platform remains reliable, cost-efficient, and secure as your business scales.",[12,8218,8219],{},[155,8220,6921,8221,8225,8226,6931],{},[731,8222,8224],{"href":6924,"rel":8223},[735],"Qpoint’s free tier"," to discover your third-party API footprint in minutes. Check out our ",[731,8227,1307],{"href":1305,"rel":8228},[735],{"title":184,"searchDepth":185,"depth":185,"links":8230},[8231,8232,8233,8234,8235,8236,8237,8238],{"id":7946,"depth":185,"text":7947},{"id":7963,"depth":185,"text":7964},{"id":8012,"depth":185,"text":8013},{"id":8054,"depth":185,"text":8055},{"id":8094,"depth":185,"text":8095},{"id":8136,"depth":185,"text":8137},{"id":8176,"depth":185,"text":8177},{"id":8212,"depth":185,"text":8213},"2024-12-16","Discover the hidden risks of third-party API dependencies—from reliability challenges to hidden costs—and learn how Qpoint uses eBPF to provide the visibility and control that operators and SREs need.","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.12.16.the.hidden\u002FListing2.png",{},"\u002Fblog\u002Fthe-hidden-risks-of-third-party-api-dependencies",{"title":7932,"description":8240},"blog\u002Fthe-hidden-risks-of-third-party-api-dependencies","Discover the unseen risks and challenges that third-party API integrations pose—from reliability issues to hidden costs—and learn how Qpoint provides the visibility and control that your ops team needs to be effective.","VU1opSfOXJBusWGDFEBVTdixwE1bUkiKwqN4dfa8zos",{"id":8249,"title":8250,"author":7,"body":8251,"date":3418,"description":8883,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":8884,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":8885,"navigation":201,"path":8886,"seo":8887,"slug":8888,"stem":8889,"subHeadline":8883,"tags":197,"__hash__":8890},"blog\u002Fblog\u002Fthe-impossible-proxy.md","The Impossible Proxy - An Egress Journey",{"type":9,"value":8252,"toc":8871},[8253,8256,8259,8262,8264,8274,8278,8281,8292,8295,8298,8301,8304,8307,8309,8316,8320,8323,8340,8343,8345,8353,8357,8360,8367,8370,8384,8390,8393,8395,8401,8405,8408,8411,8425,8428,8442,8445,8447,8455,8459,8462,8476,8479,8493,8496,8510,8513,8516,8518,8525,8529,8532,8546,8549,8552,8554,8557,8571,8574,8577,8579,8584,8588,8591,8605,8608,8610,8627,8631,8634,8683,8686,8688,8692,8698,8705,8747,8750,8753,8791,8793,8797,8800,8832,8835,8837,8840,8843,8848,8851,8853,8859,8865],[12,8254,8255],{},"\"We just need all external traffic to go through an egress proxy.\"",[12,8257,8258],{},"That's how it always starts. A seemingly simple security requirement that sounds reasonable in the boardroom. The CISO nods. The compliance team is satisfied. The architecture review board approves. And then, someone has to actually build it.",[12,8260,8261],{},"That someone is now you.",[16,8263],{},[12,8265,8266],{},[179,8267],{"alt":8268,"className":8269,"src":8273},"The Impossible Proxy@3x.png",[8270,8271,8272],"max-w-[160px]","-mb-10","mt-10","\u002Fimages\u002F2025.Q3\u002Fcoffee.tall.jpg",[29,8275,8277],{"id":8276},"month-1-the-research-phase","Month 1: The Research Phase",[12,8279,8280],{},"You start with a simple plan. First, understand the requirements:",[237,8282,8283,8286,8289],{},[240,8284,8285],{},"Security wants visibility into all outbound traffic",[240,8287,8288],{},"Compliance needs an audit trail of external communications",[240,8290,8291],{},"The risk team wants a single point of control for external access",[12,8293,8294],{},"It sounds straightforward on paper. You've done your reading – forward proxies, reverse proxies, transparent proxies. You've studied the RFCs. You understand the theory.",[12,8296,8297],{},"Your first step is logical: send out a company-wide survey asking teams to document their external dependencies. You create a simple template and distribute it with an executive sponsor's blessing.",[12,8299,8300],{},"Two weeks later, you have responses from 12 out of 70 teams.",[12,8302,8303],{},"The ones who did respond list a handful of obvious integrations: Stripe, Twilio, maybe a few public APIs. But something feels off. These are complex applications – surely they connect to more than three external services?",[12,8305,8306],{},"You create a project plan with three phases: discovery, planning, and implementation. You set a three-month timeline. Your manager approves the plan with a skeptical eyebrow.",[16,8308],{},[12,8310,8311],{},[179,8312],{"alt":8268,"className":8313,"src":8315},[8314],"max-w-[300px]","\u002Fimages\u002F2025.Q3\u002Fcoffee.two.jpg",[29,8317,8319],{"id":8318},"month-2-the-archaeology-expedition","Month 2: The Archaeology Expedition",[12,8321,8322],{},"With the survey approach clearly insufficient, you roll up your sleeves for some digital archaeology. Armed with a packet analyzer and stronger coffee, you spend weeks excavating the hidden artifacts of your infrastructure. Each layer reveals a new surprise:",[237,8324,8325,8328,8331,8334,8337],{},[240,8326,8327],{},"The payment service doesn't just call Stripe – it calls eight different endpoints across three regions",[240,8329,8330],{},"Your logging libraries silently call home to check for updates",[240,8332,8333],{},"The CI\u002FCD pipeline connects to 14 different GitHub endpoints",[240,8335,8336],{},"Your container images are pulling from five different registries",[240,8338,8339],{},"Your NPM dependencies are fetching sub-dependencies from domains you've never heard of",[12,8341,8342],{},"By month's end, you've documented over 300 external endpoints across your infrastructure. The spreadsheet grows daily. You start to realize the scale of what you're up against.",[16,8344],{},[12,8346,8347],{},[179,8348],{"alt":8268,"className":8349,"src":8352},[8350,8351],"w-auto","md:max-w-[300px]","\u002Fimages\u002F2025.Q3\u002Fcoffee.three.jpg",[29,8354,8356],{"id":8355},"month-3-the-planning-first-implementation","Month 3: The Planning & First Implementation",[12,8358,8359],{},"You design your proxy architecture: a cluster of proxy servers, high availability, load balancing, failover. You write policies for common services. You build allowlists for known domains.",[12,8361,8362,8363,8366],{},"For the first implementation, you try the simplest approach. Configure the proxy and set the ",[284,8364,8365],{},"HTTPS_PROXY"," environment variable across the fleet. Push the change to development environments.",[12,8368,8369],{},"Within minutes, Slack lights up with reports of:",[237,8371,8372,8375,8378,8381],{},[240,8373,8374],{},"Failed deployments",[240,8376,8377],{},"Broken integration tests",[240,8379,8380],{},"Development environments that won't start",[240,8382,8383],{},"Libraries that can't update",[12,8385,8386,8387,8389],{},"The troubleshooting reveals that even with environment variables like ",[284,8388,8365],{}," set, many applications and libraries either ignore these settings or implement proxy support inconsistently.",[12,8391,8392],{},"You quickly revert and regroup. This is going to be harder than you thought.",[16,8394],{},[12,8396,8397],{},[179,8398],{"alt":8268,"className":8399,"src":8400},[8314],"\u002Fimages\u002F2025.Q3\u002Fcoffee.single.jpg",[29,8402,8404],{"id":8403},"month-4-the-transparent-proxy-attempt","Month 4: The Transparent Proxy Attempt",[12,8406,8407],{},"After the first failure, you decide on a more aggressive approach: a transparent proxy using SNI inspection. Since most modern TLS connections include the Server Name Indication (SNI) in the handshake, your proxy can see the destination hostname without breaking encryption.",[12,8409,8410],{},"The plan:",[267,8412,8413,8416,8419,8422],{},[240,8414,8415],{},"Intercept all outbound traffic at the network level",[240,8417,8418],{},"Inspect the SNI field during the TLS handshake",[240,8420,8421],{},"Allow or block based on the hostname, without breaking encryption",[240,8423,8424],{},"Forward allowed connections to their destination",[12,8426,8427],{},"Two weeks later, you're dealing with a different set of problems:",[237,8429,8430,8433,8436,8439],{},[240,8431,8432],{},"Older TLS implementations don't use SNI",[240,8434,8435],{},"Some libraries disable SNI for privacy reasons",[240,8437,8438],{},"Multiple services behind a single hostname can't be distinguished",[240,8440,8441],{},"You can see destinations but can't inspect content for data loss prevention",[12,8443,8444],{},"The biggest issue: you can only allow or block connections, but you can't monitor what's actually being sent. For your security team, this is insufficient.",[16,8446],{},[12,8448,8449],{},[179,8450],{"alt":8268,"className":8451,"src":8454},[8350,8452,8453],"md:max-w-[520px]","mt-16","\u002Fimages\u002F2025.Q3\u002Fcoffee.many.jpg",[29,8456,8458],{"id":8457},"month-5-6-the-certificate-nightmare","Month 5-6: The Certificate Nightmare",[12,8460,8461],{},"You realize there's no avoiding it: to get the visibility needed, you'll have to break and inspect the encrypted traffic. This means implementing TLS interception:",[267,8463,8464,8467,8470,8473],{},[240,8465,8466],{},"Generate a custom Certificate Authority (CA)",[240,8468,8469],{},"Add this CA to every application's trust store",[240,8471,8472],{},"Configure your proxy to sign certificates on-the-fly for each destination",[240,8474,8475],{},"Intercept, decrypt, inspect, then re-encrypt all traffic",[12,8477,8478],{},"The certificate distribution alone becomes a massive project:",[237,8480,8481,8484,8487,8490],{},[240,8482,8483],{},"Updating base images for containers",[240,8485,8486],{},"Pushing certificate updates to virtual machines",[240,8488,8489],{},"Training developers on how to include the CA in their applications",[240,8491,8492],{},"Building verification systems to ensure certificates are properly installed",[12,8494,8495],{},"Meanwhile, you encounter a barrage of technical issues:",[237,8497,8498,8501,8504,8507],{},[240,8499,8500],{},"Legacy applications with hardcoded certificate stores",[240,8502,8503],{},"Certificate pinning in security-conscious libraries",[240,8505,8506],{},"Modern browsers and libraries that reject your certificates due to security features",[240,8508,8509],{},"Applications that use mutual TLS, where both client and server authenticate each other",[12,8511,8512],{},"A month after deployment, a critical integration with a financial partner starts failing intermittently. After days of debugging, you discover they're using certificate pinning – their client explicitly verifies the server's exact certificate, rejecting your proxy's substitute.",[12,8514,8515],{},"For each of these issues, you need custom solutions, exceptions, and workarounds. Your elegant proxy design is becoming a patchwork of special cases.",[16,8517],{},[12,8519,8520],{},[179,8521],{"alt":8268,"className":8522,"src":8524},[8523],"max-w-[140px]","\u002Fimages\u002F2025.Q3\u002Fcoffee.short.jpg",[29,8526,8528],{"id":8527},"month-7-the-authentication-maze","Month 7: The Authentication Maze",[12,8530,8531],{},"With certificates somewhat stabilized, new authentication problems surface:",[237,8533,8534,8537,8540,8543],{},[240,8535,8536],{},"OAuth flows that break when redirects pass through the proxy",[240,8538,8539],{},"API keys embedded in requests that now get logged by your proxy",[240,8541,8542],{},"JWT tokens with audience validation that fails through proxies",[240,8544,8545],{},"Services that validate client IP addresses, which get masked by the proxy",[12,8547,8548],{},"Each authentication method requires special handling. Your configuration grows to thousands of lines, with special cases for dozens of services.",[12,8550,8551],{},"Meanwhile, the security team is breathing down your neck. They want full visibility, but every exception you create is a potential blind spot.",[16,8553],{},[12,8555,8556],{},"Even with authentication issues partially resolved, new problems emerge. Your monitoring shows increased latency and occasional timeouts. The proxy has become a bottleneck:",[237,8558,8559,8562,8565,8568],{},[240,8560,8561],{},"Each connection requires two TLS handshakes instead of one",[240,8563,8564],{},"CPU usage spikes as proxies handle encryption\u002Fdecryption for all traffic",[240,8566,8567],{},"Connection pooling becomes ineffective with thousands of destinations",[240,8569,8570],{},"Memory usage grows with each concurrent connection",[12,8572,8573],{},"You scale up the proxy infrastructure, but costs spiral quickly. What started as a simple security project now consumes significant infrastructure budget.",[12,8575,8576],{},"The worst part? High-frequency trading APIs and real-time services report that even milliseconds of added latency impact their functionality.",[16,8578],{},[12,8580,8581],{},[179,8582],{"alt":8268,"className":8583,"src":8315},[8314],[29,8585,8587],{"id":8586},"month-9-the-container-uprising","Month 9: The Container Uprising",[12,8589,8590],{},"Just as you think you're making progress, containerization introduces new challenges:",[237,8592,8593,8596,8599,8602],{},[240,8594,8595],{},"Sidecar containers making their own external calls without proxy awareness",[240,8597,8598],{},"Init containers pulling from external registries during startup",[240,8600,8601],{},"Service meshes with their own TLS termination that conflicts with your proxy",[240,8603,8604],{},"Dynamic scaling that causes connection pools to fluctuate wildly",[12,8606,8607],{},"Each container seems to have its own ideas about how to communicate with the outside world, and none of them involve your carefully crafted proxy setup.",[16,8609],{},[683,8611,8614,8615,688,8621],{"className":8612},[686,8613],"mt-20","  ",[683,8616,4712,8617,688],{},[179,8618],{"src":8400,"alt":8619,"className":8620},"Coffee single",[8350,8351],[683,8622,4712,8623,688],{},[179,8624],{"src":8315,"alt":8625,"className":8626},"Coffee two",[8350,8351],[29,8628,8630],{"id":8629},"month-10-the-retrospection","Month 10: The Retrospection",[12,8632,8633],{},"Ten months in, you call a timeout. In a candid presentation to leadership, you outline the fundamental challenges:",[237,8635,8636,8642,8648,8654,8660,8666,8672],{},[240,8637,8638,8641],{},[155,8639,8640],{},"Incomplete Discovery",": No team knows all their external dependencies",[240,8643,8644,8647],{},[155,8645,8646],{},"TLS Complexity",": Breaking encryption creates more problems than it solves",[240,8649,8650,8653],{},[155,8651,8652],{},"Certificate Management",": Distribution and updating is a massive undertaking",[240,8655,8656,8659],{},[155,8657,8658],{},"Authentication Diversity",": Different services use incompatible authentication mechanisms",[240,8661,8662,8665],{},[155,8663,8664],{},"Scale Issues",": At microservice scale, centralized proxies become bottlenecks",[240,8667,8668,8671],{},[155,8669,8670],{},"Performance Impact",": Added latency affects critical business functions",[240,8673,8674,8677,8678],{},[155,8675,8676],{},"Container Complexity",": Modern deployment models resist centralized control\n",[179,8679],{"alt":8268,"className":8680,"src":8682},[8681,8272],"max-w-[100px]","\u002Fimages\u002F2025.Q3\u002Fcoffee.jpg",[12,8684,8685],{},"You realize you've been trying to solve a distributed problem with a centralized solution. The traditional proxy model simply doesn't work at microservice scale.",[16,8687],{},[29,8689,8691],{"id":8690},"the-breakthrough","The Breakthrough",[12,8693,8694,8695,8697],{},"The turning point comes when you discover ",[731,8696,3325],{"href":1631}," and shift your thinking from network-level interception to kernel-based visibility:",[179,8699],{"alt":8700,"className":8701,"src":8704},"Qtap platform dashboard showing encrypted traffic visibility and monitoring",[8702,5309,8703],"w-full","mb-10","\u002Fimages\u002F2025.Q3\u002Fqtap-simple-overview.svg",[267,8706,8707,8713,8726,8731,8741],{},[240,8708,8709,8712],{},[155,8710,8711],{},"Host-Based Approach",": Qpoint deploys lightweight agents that see traffic before encryption happens at the source",[240,8714,8715,8718,8719],{},[155,8716,8717],{},"Process Attribution",": Identify exactly which processes, containers, or services are initiating connections",[179,8720],{"alt":8700,"className":8721,"src":8725},[8722,8723,8702,8724,8703],"screenshot","mt-3","max-w-[700px]","\u002Fimages\u002F2025.Q3\u002Fdata-flow.png",[240,8727,8728,8730],{},[155,8729,7617],{},": Access the content of external calls without breaking TLS or managing certificates",[240,8732,8733,8736,8737],{},[155,8734,8735],{},"Real-Time Discovery",": Automatically catalog all external endpoints your applications actually use in production",[179,8738],{"alt":8700,"className":8739,"src":8740},[8722,8723,8702,8724,8703],"\u002Fimages\u002F2025.Q3\u002Fscreengrabs\u002Finventory.spread.zoomout.jpg",[240,8742,8743,8746],{},[155,8744,8745],{},"Non-Invasive Implementation",": Deploy without changing application code or network architecture",[12,8748,8749],{},"Instead of a monolithic proxy breaking and rebuilding all TLS connections, Qpoint provides a distributed system of visibility and control – one that works with your architecture rather than against it.",[12,8751,8752],{},"The difference is transformative:",[237,8754,8755,8761,8767,8773,8779,8785],{},[240,8756,8757,8760],{},[155,8758,8759],{},"Complete Visibility",": See all external connections, including those from libraries and dependencies",[240,8762,8763,8766],{},[155,8764,8765],{},"Zero Certificate Hassles",": No need to distribute custom CAs or deal with certificate pinning issues",[240,8768,8769,8772],{},[155,8770,8771],{},"Performance Preservation",": No added latency since traffic isn't routed through a centralized bottleneck",[240,8774,8775,8778],{},[155,8776,8777],{},"Granular Control",": Apply policies based on process identity, not just destination",[240,8780,8781,8784],{},[155,8782,8783],{},"Actual Payloads",": Capture the real content of API calls when needed for debugging or security",[240,8786,8787,8790],{},[155,8788,8789],{},"Deployment Simplicity",": Roll out incrementally without disrupting existing services",[16,8792],{},[29,8794,8796],{"id":8795},"the-reality-check","The Reality Check",[12,8798,8799],{},"The truth about implementing egress proxies in complex microservice environments isn't about finding the perfect technical solution. It's about recognizing that:",[237,8801,8802,8808,8814,8820,8826],{},[240,8803,8804,8807],{},[155,8805,8806],{},"TLS Wasn't Designed for Interception",": The security properties of TLS deliberately make intermediaries difficult",[240,8809,8810,8813],{},[155,8811,8812],{},"Complete Control Is an Illusion",": In highly distributed systems, you need governance, not absolute control",[240,8815,8816,8819],{},[155,8817,8818],{},"Context Matters More Than Barriers",": Understanding what's happening is more valuable than blindly blocking traffic",[240,8821,8822,8825],{},[155,8823,8824],{},"Security Must Scale",": Security controls must be as distributed as the systems they protect",[240,8827,8828,8831],{},[155,8829,8830],{},"Visibility Precedes Control",": You can't effectively control what you can't see",[12,8833,8834],{},"The journey teaches you something profound: in modern architectures, the context around connections – why they exist, what data they carry, which processes initiate them – matters more than simply routing them through a checkpoint.",[16,8836],{},[12,8838,8839],{},"Rather than a single proxy to rule them all, what organizations truly need is a control plane for external connections – one that provides visibility first, then enables intelligent, context-aware controls that work with the grain of your infrastructure, not against it.",[12,8841,8842],{},"With Qpoint, you finally get the missing context – comprehensive visibility into your external services without the architectural compromises that made traditional proxies so problematic in modern environments. By tapping into connections at their source using eBPF technology, Qpoint brings your external services into focus, exactly where traditional tools have left you blind.",[179,8844],{"alt":8700,"className":8845,"src":8847},[8723,8702,8846,8703],"max-w-[440px]","\u002Fimages\u002F2025.Q3\u002Fvisibility.3@2x.png",[12,8849,8850],{},"Because when you're dealing with thousands of microservices, each with its own external dependencies, the impossible proxy doesn't have to be a proxy at all.",[16,8852],{},[12,8854,8855],{},[250,8856,7899,8857,7902],{},[731,8858,3387],{"href":1311},[12,8860,8861],{},[250,8862,7907,8863,7912],{},[731,8864,7911],{"href":7910},[179,8866],{"alt":8700,"className":8867,"src":8870},[8702,8868,8703,8869,8613],"max-w-[240px]","mx-auto","\u002Fimages\u002F2025.Q3\u002F2025.09.22.impossible.proxy.plants.2.jpg",{"title":184,"searchDepth":185,"depth":185,"links":8872},[8873,8874,8875,8876,8877,8878,8879,8880,8881,8882],{"id":8276,"depth":185,"text":8277},{"id":8318,"depth":185,"text":8319},{"id":8355,"depth":185,"text":8356},{"id":8403,"depth":185,"text":8404},{"id":8457,"depth":185,"text":8458},{"id":8527,"depth":185,"text":8528},{"id":8586,"depth":185,"text":8587},{"id":8629,"depth":185,"text":8630},{"id":8690,"depth":185,"text":8691},{"id":8795,"depth":185,"text":8796},"We just need all external traffic to go through an egress proxy. That's how it always starts. A seemingly simple security requirement that sounds reasonable in the boardroom. The CISO nods. The compliance team is satisfied. The architecture review board approves. And then, someone has to actually build it.","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.09.09.impossible\u002Fimpossible-proxy.png",{},"\u002Fblog\u002Fthe-impossible-proxy",{"title":8250,"description":8883},"the-impossible-proxy","blog\u002Fthe-impossible-proxy","e74mjc1EazMLE46WEeur3mAUQjnlBahNEDk19hAsymI",{"id":8892,"title":8893,"author":5565,"body":8894,"date":9117,"description":9118,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":9119,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":9120,"navigation":201,"path":9121,"seo":9122,"slug":9123,"stem":9124,"subHeadline":9118,"tags":197,"__hash__":9125},"blog\u002Fblog\u002Fthe-truth-is-on-the-wire.md","The Truth is on the Wire",{"type":9,"value":8895,"toc":9109},[8896,8905,8908,8910,8914,8923,8926,8929,8932,8935,8938,8947,8949,8953,8962,8968,8979,8985,8991,8994,8996,9000,9008,9014,9020,9026,9029,9031,9035,9038,9044,9050,9056,9062,9065,9067,9071,9083,9086,9088,9092,9095],[12,8897,8898,8899,8904],{},"Modern applications thrive on external integrations—APIs, ",[731,8900,8903],{"href":8901,"rel":8902},"https:\u002F\u002Fwww.qpoint.io\u002Fblog\u002Fthe-hidden-risks-of-third-party-api-dependencies",[735],"third-party services",", and cloud platforms—all working together to power seamless digital experiences. However, when something goes wrong, finding the root cause can be frustrating and time-consuming. The truth behind these issues often lies \"on the wire,\" within the raw data exchanged between your application and its external dependencies.",[12,8906,8907],{},"While traditional tools help monitor application performance or network health, they often miss the intricate details of what’s happening at this critical intersection. Qpoint was built to change that. By offering deep, actionable insights at the \"wire\" level, it provides a source of truth that teams can use to uncover the real story behind failures and anomalies that is often obscured by layers of abstraction and tooling.",[16,8909],{},[73,8911,8913],{"id":8912},"why-visibility-into-wire-data-matters","Why Visibility into Wire Data Matters",[12,8915,8916,8917,8922],{},"For platform engineers and developers, ",[731,8918,8921],{"href":8919,"rel":8920},"https:\u002F\u002Fwww.qpoint.io\u002Fblog\u002Ftap-into-your-egress-traffic-with-ebpf",[735],"external integrations"," and micro-services introduce layers of complexity that can cloud visibility into what’s happening during production incidents. Common questions often go unanswered:",[12,8924,8925],{},"Did we change something?",[12,8927,8928],{},"Is a malformed request causing a downstream issue?",[12,8930,8931],{},"Did an integration send unexpected data back to the app?",[12,8933,8934],{},"Are there new or unfamiliar endpoints that our app is suddenly communicating with?",[12,8936,8937],{},"Is the issue on our side or the vendor’s?",[12,8939,8940,8941,8946],{},"These are the kinds of questions that ",[731,8942,8945],{"href":8943,"rel":8944},"https:\u002F\u002Fwww.qpoint.io\u002Fblog\u002Fwhats-the-difference-between-my-apm-tool-and-qpoint",[735],"traditional application performance monitoring (APM) tools struggle to answer",". Logs and traces are useful but can’t provide the full picture of what's happening at the wire level—where the actual data flows occur. This gap slows debugging and keeps teams stuck in firefighting mode.",[16,8948],{},[73,8950,8952],{"id":8951},"shedding-light-on-hidden-third-party-interactions","Shedding Light on Hidden Third-Party Interactions",[12,8954,8955,8956,8961],{},"Qpoint operates at the point where applications meet their dependencies, providing unmatched visibility into outbound traffic flows. With its ",[731,8957,8960],{"href":8958,"rel":8959},"https:\u002F\u002Fwww.qpoint.io\u002Fblog\u002Fwhat-is-ebpf",[735],"eBPF-powered"," observability capabilities, Qpoint enables teams to:",[12,8963,8964,8967],{},[155,8965,8966],{},"Debug Faster:"," Dive into request-level data to pinpoint issues like incorrect API keys or malformed payloads.",[12,8969,8970,351,8973,8978],{},[155,8971,8972],{},"Improve Root Cause Analysis:",[731,8974,8977],{"href":8975,"rel":8976},"https:\u002F\u002Fwww.qpoint.io\u002F#3",[735],"Quickly determine"," whether an issue is internal or external by inspecting traffic patterns and responses.",[12,8980,8981,8984],{},[155,8982,8983],{},"Expose Unintended Data Flows:"," Identify sensitive data or misconfigured connections that may pose security or operational risks.",[12,8986,8987,8990],{},[155,8988,8989],{},"Optimize Troubleshooting:"," Gain insights into which external systems your app is interacting with, how they respond, and where anomalies are occurring.",[12,8992,8993],{},"These capabilities mean that teams can not only resolve incidents faster but also prevent recurring issues from turning into systemic problems​​​.",[16,8995],{},[73,8997,8999],{"id":8998},"how-qpoint-achieves-unmatched-visibility","How Qpoint Achieves Unmatched Visibility",[12,9001,9002,9003,9007],{},"At the core of ",[731,9004,9006],{"href":8943,"rel":9005},[735],"Qpoint’s"," capability is eBPF, a transformative Linux kernel technology that allows the platform to tap directly into your application’s traffic flows:",[12,9009,9010,9013],{},[155,9011,9012],{},"Full Payload Insights:"," Qpoint captures traffic before encryption, offering visibility into both the content and context of requests without interfering with TLS.",[12,9015,9016,9019],{},[155,9017,9018],{},"Low Overhead, High Performance:"," eBPF enables detailed monitoring with negligible impact on system performance, making it suitable even for high-traffic environments.",[12,9021,9022,9025],{},[155,9023,9024],{},"No Code Changes Required:"," Qpoint deploys in minutes without requiring changes to your applications or infrastructure.",[12,9027,9028],{},"By operating below the app layer, Qpoint delivers a raw and unfiltered view of what’s happening across your system’s external connections, giving you the insights you need to fix issues effectively​​​.",[16,9030],{},[73,9032,9034],{"id":9033},"unlock-critical-insights-to-optimize-debugging","Unlock Critical Insights to Optimize Debugging",[12,9036,9037],{},"Qpoint empowers teams to:",[12,9039,9040,9043],{},[155,9041,9042],{},"Pinpoint Payload Problems:"," Quickly identify malformed requests or unexpected responses that may cause failures in production.",[12,9045,9046,9049],{},[155,9047,9048],{},"Understand New or Unknown Connections:"," Gain visibility into outbound traffic to uncover previously unknown endpoints or dependencies.",[12,9051,9052,9055],{},[155,9053,9054],{},"Trace Issue Sources:"," Determine whether problems stem from your application, the network, or the external vendor, minimizing finger-pointing during incidents.",[12,9057,9058,9061],{},[155,9059,9060],{},"Strengthen Data Governance:"," Ensure sensitive or regulated data doesn’t leave your environment unintentionally by inspecting outbound traffic in real time.",[12,9063,9064],{},"By providing precise, actionable insights, Qpoint transforms troubleshooting into a proactive, manageable process​​​.",[16,9066],{},[73,9068,9070],{"id":9069},"a-new-approach-to-observability","A New Approach to Observability",[12,9072,9073,9074,9079,9080,5586],{},"One customer described ",[731,9075,9078],{"href":9076,"rel":9077},"https:\u002F\u002Fwww.qpoint.io\u002F#use-cases",[735],"the experience of using Qpoint"," like this: \"",[250,9081,9082],{},"It’s like having a magnifying glass for your external dependencies. When we couldn’t find the problem anywhere else, Qpoint showed us exactly what was happening on the wire.",[12,9084,9085],{},"This level of clarity changes the game for teams managing modern, highly integrated systems. When other tools fall short, Qpoint steps in, offering the visibility needed to resolve complex issues quickly and keep systems running smoothly.",[16,9087],{},[73,9089,9091],{"id":9090},"see-qpoint-in-action","See Qpoint in Action",[12,9093,9094],{},"Troubleshooting modern applications doesn’t have to be a guessing game. With Qpoint, you gain the ability to see precisely what’s happening on the wire, transforming how your team handles debugging, troubleshooting, and operational efficiency.",[12,9096,9097,9098,9102,9103,9108],{},"Ready to experience Qpoint first hand?",[731,9099,351],{"href":9100,"rel":9101},"https:\u002F\u002Fwww.qpoint.io",[735],"Check out our",[731,9104,9107],{"href":9105,"rel":9106},"https:\u002F\u002Fapp.qpoint.io\u002Fsign-in?demo=true",[735]," live demo"," and let us know what you think!",{"title":184,"searchDepth":185,"depth":185,"links":9110},[9111,9112,9113,9114,9115,9116],{"id":8912,"depth":191,"text":8913},{"id":8951,"depth":191,"text":8952},{"id":8998,"depth":191,"text":8999},{"id":9033,"depth":191,"text":9034},{"id":9069,"depth":191,"text":9070},{"id":9090,"depth":191,"text":9091},"2025-02-04","By tapping into raw wire data, Qpoint can offer deep, actionable insights to help organizations troubleshoot and solve issues that traditional APM tools struggle to find.","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2025.02.04\u002FThe Truth is on the Wire.png",{},"\u002Fblog\u002Fthe-truth-is-on-the-wire",{"title":8893,"description":9118},"the-truth-is-on-the-wire","blog\u002Fthe-truth-is-on-the-wire","k9EG4_GOBDBbL4Dqxl9796e2tiaib4sJQW1odRti7-M",{"id":9127,"title":9128,"author":5565,"body":9129,"date":9241,"description":9242,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":9243,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":9244,"navigation":201,"path":9245,"seo":9246,"slug":9247,"stem":9248,"subHeadline":9242,"tags":197,"__hash__":9249},"blog\u002Fblog\u002Fturning-blind-spots-into-insights-for-platform-teams-and-sre.md","Turning Blind Spots Into Visibility and Insights for SRE Teams",{"type":9,"value":9130,"toc":9237},[9131,9140,9149,9156,9159,9162,9164,9168,9173,9176,9181,9188,9193,9196,9201,9210,9212,9216,9224],[12,9132,9133,9134,9139],{},"Just as a networking team meticulously maps out every connection, router, and switch to ensure reliability and seamless communication, today’s platform and SRE teams need precise visibility into their applications’ interactions with third-party services to maintain seamless operations. Qpoint makes that possible with ",[731,9135,9138],{"href":9136,"rel":9137},"https:\u002F\u002Fwww.qpoint.io\u002Fblog\u002Fqpoint-closes-pre-seed-funding-and-launches-ebpf-based-visibility-and-control-for-critical-external-services",[735],"advanced eBPF-powered technology"," that sheds light on the increasingly opaque world of external service integrations.",[12,9141,9142,9143,9148],{},"With Qpoint, operators can ",[731,9144,9147],{"href":9145,"rel":9146},"https:\u002F\u002Fwww.qpoint.io\u002Fblog\u002Fmanaging-external-integrations-in-production-environments",[735],"monitor external integrations",", troubleshoot faster, and prevent costly outages, all without code changes. It’s the ultimate tool for operators who need complete control and transparency in a landscape where external dependencies are multiplying.",[12,9150,9151],{},[250,9152,9153],{},[155,9154,9155],{},"\"Qpoint gives you visibility that you never had before. It’s like turning on the lights in a room that was always dark.\" – Tyler Flint, Co-Founder of Qpoint",[12,9157,9158],{},"Qpoint was born out of a simple but powerful realization: as applications become more reliant on third-party services, the need for comprehensive observability into external dependencies has never been greater. Founder Tyler Flint, a serial entrepreneur with deep roots in infrastructure and operations, knew Qpoint could build a solution that brings clarity to a complex and critical area often overlooked by traditional tools.",[12,9160,9161],{},"Today, Qpoint is building a reputation as the go-to solution for operators seeking deeper insights and control over external dependencies.",[16,9163],{},[73,9165,9167],{"id":9166},"why-leading-operations-teams-choose-qpoint","Why Leading Operations Teams Choose Qpoint",[12,9169,9170],{},[155,9171,9172],{},"Unmatched Visibility into External Traffic",[12,9174,9175],{},"Qpoint taps directly into egress traffic to deliver real-time insights into every interaction between your applications and their external dependencies. Whether it’s monitoring API calls to key vendors, keeping tabs on data flows, or detecting errors before they escalate, Qpoint ensures that nothing slips through the cracks.",[12,9177,9178],{},[155,9179,9180],{},"Zero Touch, Zero Disruption with eBPF",[12,9182,9183,9184,9187],{},"Built on cutting-edge ",[731,9185,1221],{"href":8958,"rel":9186},[735],", Qpoint operates seamlessly without impacting application performance or requiring changes to your existing codebase. It’s the non-intrusive solution that empowers a team to take action without adding complexity.",[12,9189,9190],{},[155,9191,9192],{},"Real-Time Alerts That Keep You Ahead of Issues",[12,9194,9195],{},"Qpoint's advanced alerting system notifies you instantly of unusual behavior or potential threats, allowing you to react before minor issues become major problems. This proactive approach is critical in today’s fast-paced tech environment, where every second counts.",[12,9197,9198],{},[155,9199,9200],{},"Enhanced Security and Compliance",[12,9202,9203,9204,9209],{},"In a world where sensitive data exposure can devastate businesses, Qpoint provides the tools to keep external data flows well understood and ",[731,9205,9208],{"href":9206,"rel":9207},"https:\u002F\u002Fwww.qpoint.io\u002Fblog\u002Fmeeting-regulatory-compliance-requirements-for-your-external-integrations",[735],"compliant with regulations"," like GDPR and HIPAA. By monitoring and controlling traffic to third-party services, Qpoint helps teams protect sensitive information and meet stringent data governance requirements.",[16,9211],{},[73,9213,9215],{"id":9214},"take-control-of-your-third-party-apis-and-external-traffic","Take Control of Your Third-Party APIs and External Traffic",[12,9217,9218,9219,9223],{},"From fast-growing startups to established enterprises, ",[731,9220,3325],{"href":9221,"rel":9222},"https:\u002F\u002Fwww.qpoint.io\u002F",[735]," is the platform of choice for those who refuse to leave their external dependencies to chance. With a focus on operational resilience, productivity, and data governance, Qpoint is helping organizations stay one step ahead in a world where external connectivity is increasing at an unprecedented pace.",[12,9225,9226],{},[155,9227,9228,9229,9232,9233,9236],{},"Ready to experience the Qpoint difference? Visit our ",[731,9230,9231],{"href":4155},"website"," or ",[731,9234,9235],{"href":1311},"schedule a demo"," today and see how Qpoint can transform the way your ops team manages its applications’ third-party dependencies and external traffic flows.",{"title":184,"searchDepth":185,"depth":185,"links":9238},[9239,9240],{"id":9166,"depth":191,"text":9167},{"id":9214,"depth":191,"text":9215},"2024-11-14","Qpoint provides game-changing visibility into external service dependencies and third-party API traffic for ops teams looking to keep their production applications resilient, secure, and cost-effective.","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.11.14\u002Fqpoint-default-seo.png",{},"\u002Fblog\u002Fturning-blind-spots-into-insights-for-platform-teams-and-sre",{"title":9128,"description":9242},"turning-blind-spots-into-insights-for-platform-teams-and-sre","blog\u002Fturning-blind-spots-into-insights-for-platform-teams-and-sre","6WPtuDdzh4PrfNISHrib-o5fsZ3A2F5rmylV-oyb5Ic",{"id":9251,"title":9252,"author":7,"body":9253,"date":9713,"description":9714,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":9715,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":9716,"navigation":201,"path":7976,"seo":9717,"slug":9718,"stem":9719,"subHeadline":9714,"tags":197,"__hash__":9720},"blog\u002Fblog\u002Funcovering-the-hidden-footprint-of-your-third-party-api-integrations.md","Uncovering the Hidden Footprint of Your Third-Party API Integrations",{"type":9,"value":9254,"toc":9700},[9255,9262,9266,9269,9272,9276,9281,9292,9297,9305,9310,9321,9326,9337,9341,9346,9360,9365,9376,9381,9392,9397,9408,9412,9417,9428,9431,9436,9444,9448,9459,9463,9468,9479,9484,9495,9500,9511,9516,9527,9531,9536,9547,9552,9563,9568,9579,9584,9588,9596,9598,9601,9603,9606,9608,9615,9617,9620,9624,9627,9629,9632,9634,9637,9641,9648,9650,9653,9655,9658,9663,9666,9668,9671,9673,9677,9684,9686,9689],[12,9256,9257,9258,9261],{},"\"Our API footprint is pretty simple - just a handful of core integrations.\" This common perception among engineering teams is understandable. Most organizations carefully track their business-critical integrations and maintain detailed documentation for their known third-party dependencies. But when teams gain true visibility into their ",[731,9259,9260],{"href":6433},"production systems' HTTPS communications",", reality often tells a different story.",[29,9263,9265],{"id":9264},"the-great-discovery","The Great Discovery",[12,9267,9268],{},"When organizations first deploy comprehensive API monitoring across their environments, the results are often eye-opening. Dashboards light up with dozens, sometimes hundreds, of previously invisible HTTPS endpoints. \"We had no idea we were making API calls to all of these services\" is a common reaction. This revelation isn't unique to any particular company or team size—it's a pattern we've observed consistently across the industry, from small startups to large enterprises.",[12,9270,9271],{},"Let's break down what teams typically discover when they get full visibility into their HTTPS traffic:",[73,9273,9275],{"id":9274},"_1-observability-apis","1. Observability APIs",[12,9277,9278],{},[155,9279,9280],{},"APM Services",[237,9282,9283,9286,9289],{},[240,9284,9285],{},"Multiple New Relic API endpoints (collector.newrelic.com, metric-api.newrelic.com)",[240,9287,9288],{},"Datadog API calls (api.datadoghq.com, intake.logs.datadoghq.com)",[240,9290,9291],{},"Dynatrace API endpoints for different telemetry types",[12,9293,9294],{},[155,9295,9296],{},"Error Tracking",[237,9298,9299,9302],{},[240,9300,9301],{},"Sentry.io API endpoints for error reporting",[240,9303,9304],{},"Exception handling webhook endpoints",[12,9306,9307],{},[155,9308,9309],{},"Logging Services",[237,9311,9312,9315,9318],{},[240,9313,9314],{},"Splunk HTTP Event Collector endpoints",[240,9316,9317],{},"Elasticsearch API endpoints",[240,9319,9320],{},"LogDNA\u002FMezmo ingestion APIs",[12,9322,9323],{},[155,9324,9325],{},"Metrics APIs",[237,9327,9328,9331,9334],{},[240,9329,9330],{},"Prometheus remote write API endpoints",[240,9332,9333],{},"Custom metrics aggregation APIs",[240,9335,9336],{},"Cloud provider metrics APIs",[73,9338,9340],{"id":9339},"_2-cloud-provider-apis","2. Cloud Provider APIs",[12,9342,9343],{},[155,9344,9345],{},"AWS Services",[237,9347,9348,9351,9354,9357],{},[240,9349,9350],{},"Systems Manager API (ssm.us-west-2.amazonaws.com)",[240,9352,9353],{},"ECR API endpoints for container pulls",[240,9355,9356],{},"S3 API endpoints for object storage",[240,9358,9359],{},"STS endpoints for token refresh",[12,9361,9362],{},[155,9363,9364],{},"Event Streaming",[237,9366,9367,9370,9373],{},[240,9368,9369],{},"Confluent Cloud API endpoints (api.confluent.cloud)",[240,9371,9372],{},"Schema registry API calls",[240,9374,9375],{},"Kafka REST proxy endpoints",[12,9377,9378],{},[155,9379,9380],{},"GCP Services",[237,9382,9383,9386,9389],{},[240,9384,9385],{},"Container Registry APIs",[240,9387,9388],{},"Cloud Storage APIs",[240,9390,9391],{},"Service account credential APIs",[12,9393,9394],{},[155,9395,9396],{},"Azure Services",[237,9398,9399,9402,9405],{},[240,9400,9401],{},"Azure Container Registry endpoints",[240,9403,9404],{},"Blob Storage APIs",[240,9406,9407],{},"Key Vault APIs",[73,9409,9411],{"id":9410},"_3-security-and-compliance-apis","3. Security and Compliance APIs",[12,9413,9414],{},[155,9415,9416],{},"Vulnerability Scanning",[237,9418,9419,9422,9425],{},[240,9420,9421],{},"Snyk API endpoints for dependency scanning",[240,9423,9424],{},"Rapid7 InsightVM API endpoints (insight.rapid7.com)",[240,9426,9427],{},"Security scanner update APIs",[12,9429,9430],{},"CVE database sync endpoints",[12,9432,9433],{},[155,9434,9435],{},"Certificate Services",[237,9437,9438,9441],{},[240,9439,9440],{},"Let's Encrypt ACME protocol endpoints",[240,9442,9443],{},"Certificate authority API endpoints",[12,9445,9446],{},[155,9447,986],{},[237,9449,9450,9453,9456],{},[240,9451,9452],{},"Cloudflare API endpoints",[240,9454,9455],{},"WAF configuration APIs",[240,9457,9458],{},"Threat intelligence feed APIs",[73,9460,9462],{"id":9461},"_4-development-infrastructure","4. Development Infrastructure",[12,9464,9465],{},[155,9466,9467],{},"Package Management",[237,9469,9470,9473,9476],{},[240,9471,9472],{},"npm registry API calls (registry.npmjs.org)",[240,9474,9475],{},"PyPI API endpoints (pypi.org)",[240,9477,9478],{},"Maven repository APIs",[12,9480,9481],{},[155,9482,9483],{},"Version Control",[237,9485,9486,9489,9492],{},[240,9487,9488],{},"GitHub API calls (api.github.com)",[240,9490,9491],{},"GitLab API endpoints",[240,9493,9494],{},"Bitbucket API calls",[12,9496,9497],{},[155,9498,9499],{},"CI\u002FCD Systems",[237,9501,9502,9505,9508],{},[240,9503,9504],{},"Jenkins API endpoints",[240,9506,9507],{},"CircleCI API calls",[240,9509,9510],{},"Docker Hub API endpoints",[12,9512,9513],{},[155,9514,9515],{},"Feature Management",[237,9517,9518,9521,9524],{},[240,9519,9520],{},"LaunchDarkly API endpoints (app.launchdarkly.com)",[240,9522,9523],{},"Unleash feature flag APIs (unleash-hosted.com)",[240,9525,9526],{},"Split.io API endpoints",[73,9528,9530],{"id":9529},"_5-business-and-product-integration-apis","5. Business and Product Integration APIs",[12,9532,9533],{},[155,9534,9535],{},"Authentication",[237,9537,9538,9541,9544],{},[240,9539,9540],{},"Okta API endpoints (your-domain.okta.com)",[240,9542,9543],{},"Auth0 authentication APIs",[240,9545,9546],{},"SAML identity provider endpoints",[12,9548,9549],{},[155,9550,9551],{},"Communication Services",[237,9553,9554,9557,9560],{},[240,9555,9556],{},"SendGrid API endpoints (api.sendgrid.com)",[240,9558,9559],{},"Twilio API calls",[240,9561,9562],{},"Slack webhook endpoints",[12,9564,9565],{},[155,9566,9567],{},"Product Analytics",[237,9569,9570,9573,9576],{},[240,9571,9572],{},"Segment API calls",[240,9574,9575],{},"Amplitude data collection endpoints",[240,9577,9578],{},"Mixpanel event APIs",[12,9580,9581],{},[179,9582],{"alt":184,"src":9583},"\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.12.03.uncovering.the\u002F8de07beb-c1f2-48b0-b922-f07c3d2523fe.png",[29,9585,9587],{"id":9586},"why-api-discovery-matters","Why API Discovery Matters",[12,9589,9590,9591,9595],{},"The sprawling landscape of HTTPS integrations in modern organizations presents several critical challenges that can't be ignored. First and foremost is the security risk - each API endpoint your systems communicate with represents a potential vector for data exfiltration or compromise. This risk is compounded by the fact that many teams don't have a complete picture of their API footprint, making it impossible to ",[731,9592,9594],{"href":9593},"\u002Fblog\u002Fwhy-securing-egress-traffic-matters","properly secure"," all communication channels.",[16,9597],{},[12,9599,9600],{},"Cost implications also loom large in this landscape. Many third-party APIs operate on usage-based billing models, and without proper visibility, costs can spiral unexpectedly. Teams often discover they're paying for redundant services or inefficient API usage patterns that could be optimized with proper oversight.",[16,9602],{},[12,9604,9605],{},"Rate limiting presents another significant challenge. Modern applications often hit API rate limits unexpectedly, leading to service disruptions. These issues typically emerge from a lack of visibility into the aggregate API call patterns across different services and teams. What seems like reasonable API usage from one team's perspective might contribute to systemic issues when combined with calls from other parts of the organization.",[16,9607],{},[12,9609,9610,9611,9614],{},"Data privacy concerns are equally pressing. Without proper monitoring, sensitive data might be shared with third-party APIs without appropriate oversight or controls. This is particularly crucial in industries with ",[731,9612,9613],{"href":6523},"strict regulatory requirements",", where unauthorized data sharing could lead to compliance violations.",[16,9616],{},[12,9618,9619],{},"Finally, each API integration represents a potential point of failure in your system. The more integrations you have, the more complex your dependency chain becomes, and the harder it is to maintain reliable service levels.",[29,9621,9623],{"id":9622},"common-surprises-in-api-discovery","Common Surprises in API Discovery",[12,9625,9626],{},"When teams first gain visibility into their API landscape, several common patterns emerge that often surprise even experienced platform teams. Abandoned API integrations frequently come to light during discovery exercises. These are endpoints that were supposed to be deprecated but continue to receive calls from legacy systems or forgotten integration points. These zombie integrations often consume resources and present security risks without providing any business value.",[16,9628],{},[12,9630,9631],{},"Perhaps most concerning is the discovery of development or testing APIs still being called from production environments. These might include sandbox environments, test endpoints, or staging APIs that should never be accessed by production systems. Such connections can pose significant security risks and may indicate gaps in deployment processes.",[16,9633],{},[12,9635,9636],{},"Teams also commonly uncover unexpected API usage patterns that warrant optimization. These include high-frequency health check calls that could be tuned, redundant API calls fetching the same data from multiple services, and chatty API patterns that could be batched for better efficiency.",[29,9638,9640],{"id":9639},"taking-action-on-api-discovery","Taking Action on API Discovery",[12,9642,9643,9644,9647],{},"Armed with ",[731,9645,9646],{"href":9245},"visibility into your API landscape",", several concrete steps can help bring order to the chaos. Begin with a comprehensive audit and rationalization effort. This involves mapping all API endpoints and their purposes, identifying redundant or unnecessary calls, and consolidating similar integrations where possible. The goal isn't just to document what exists, but to understand why each integration is necessary and whether it's being used effectively.",[16,9649],{},[12,9651,9652],{},"Optimization represents the next crucial phase. Look for opportunities to implement API call caching where appropriate, especially for frequently requested data that doesn't need to be real-time. Consider batching API calls to reduce network overhead and implement more efficient polling strategies. Often, simple changes to API call patterns can significantly reduce both costs and system load.",[16,9654],{},[12,9656,9657],{},"Security measures should be implemented systematically across all discovered endpoints. This includes ensuring proper API authentication mechanisms are in place, monitoring for sensitive data in API payloads, and enforcing TLS best practices. Pay particular attention to endpoints that handle sensitive data or provide access to critical systems.",[12,9659,9660],{},[179,9661],{"alt":184,"src":9662},"\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.12.03.uncovering.the\u002F5289bcf4-42af-458d-8923-6613f534b525.png",[12,9664,9665],{},"Finally, implement robust cost control measures. This goes beyond simple monitoring - track API call volumes and patterns to identify opportunities for optimization. Look for ways to reduce unnecessary API calls and optimize usage tiers across services. Consider implementing API quotas or alerts to prevent unexpected cost overruns.",[16,9667],{},[12,9669,9670],{},"The key to success in managing your API landscape is maintaining continuous visibility. Regular audits and monitoring help ensure that new integrations follow established best practices and that existing integrations continue to serve their intended purposes efficiently and securely.",[16,9672],{},[29,9674,9676],{"id":9675},"qpoint-makes-api-discovery-and-monitoring-easy","Qpoint Makes API Discovery and Monitoring Easy",[12,9678,9679,9680,9683],{},"The reality is that modern production systems make far more API calls than we typically realize. The first step to managing this complexity is understanding it. Tools like",[731,9681,9682],{"href":4155}," Qpoint"," that provide automatic discovery and continuous monitoring of HTTPS traffic are becoming essential for maintaining secure, efficient, and compliant systems.",[16,9685],{},[12,9687,9688],{},"Remember: you can't secure what you can't see, and you can't optimize what you don't measure. The true scope of your API integrations might surprise you—but knowing is the first step to improving.",[12,9690,9691,9692,9232,9696,9699],{},"Ready to experience the Qpoint difference? ",[731,9693,9695],{"href":6924,"rel":9694},[735],"Try now for free",[731,9697,9698],{"href":1311},"schedule a demo today"," and see how Qpoint can transform the way your ops team manages its applications’ third-party dependencies and external traffic flows.",{"title":184,"searchDepth":185,"depth":185,"links":9701},[9702,9709,9710,9711,9712],{"id":9264,"depth":185,"text":9265,"children":9703},[9704,9705,9706,9707,9708],{"id":9274,"depth":191,"text":9275},{"id":9339,"depth":191,"text":9340},{"id":9410,"depth":191,"text":9411},{"id":9461,"depth":191,"text":9462},{"id":9529,"depth":191,"text":9530},{"id":9586,"depth":185,"text":9587},{"id":9622,"depth":185,"text":9623},{"id":9639,"depth":185,"text":9640},{"id":9675,"depth":185,"text":9676},"2024-12-03","Learn how Qpoint reveals your true third-party API footprint to boost platform reliability, control costs, and ensure compliance.","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.12.03.uncovering.the\u002Funcovering blog - listing.png",{},{"title":9252,"description":9714},"uncovering-the-hidden-footprint-of-your-third-party-api-integrations","blog\u002Funcovering-the-hidden-footprint-of-your-third-party-api-integrations","9Ljwa3rIuOGAZiPtrmyvHktoeEhFiaBGo37w2mkB69Y",{"id":9722,"title":9723,"author":5565,"body":9724,"date":9881,"description":9882,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":9883,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":9884,"navigation":201,"path":7782,"seo":9885,"slug":9886,"stem":9887,"subHeadline":9882,"tags":197,"__hash__":9888},"blog\u002Fblog\u002Fwhat-is-ebpf.md","What is eBPF?",{"type":9,"value":9725,"toc":9873},[9726,9733,9737,9740,9743,9747,9751,9754,9780,9784,9787,9790,9796,9800,9813,9816,9820,9823,9843,9849,9853,9860,9863,9865,9868],[12,9727,9728,9729,9732],{},"eBPF (extended Berkeley Packet Filter) is arguably the most groundbreaking technology in the Linux ecosystem today. Initially designed for filtering network packets, eBPF has grown into a powerful and versatile tool that provides deep insights into system behavior—without requiring complex changes or introducing performance overhead. Whether you’re troubleshooting ",[731,9730,9731],{"href":8021},"application performance",", tracing a network issue, or enhancing security, eBPF unlocks a new level of visibility into what's happening at the core of your systems.",[73,9734,9736],{"id":9735},"ebpf-overview","eBPF Overview",[12,9738,9739],{},"At its core, eBPF allows custom programs to be executed directly within the Linux kernel, without needing to alter kernel code itself. This gives developers, operators, and security professionals the ability to monitor, trace, and even tweak system behavior at a granular level—such as network traffic, system calls, or file operations—while maintaining system performance and stability.",[12,9741,9742],{},"What makes eBPF so useful is how it’s designed for safety and efficiency. Traditional kernel modules come with risks, including system crashes if something goes wrong. But with eBPF, programs are verified to be safe before execution, meaning they can’t cause instability. Even better, these programs can be run without recompiling the kernel or rebooting the system, making eBPF a non-disruptive, highly valuable tool.",[73,9744,9746],{"id":9745},"how-does-ebpf-technology-work","How Does eBPF Technology Work?",[1179,9748,9750],{"id":9749},"terms-concepts","Terms & Concepts",[12,9752,9753],{},"Before we dive into how eBPF works, here are a few important terms:",[237,9755,9756,9762,9768,9774],{},[240,9757,9758,9761],{},[155,9759,9760],{},"BPF Maps",": Storage spaces that eBPF programs can use to store and share data, such as metrics or system statistics.",[240,9763,9764,9767],{},[155,9765,9766],{},"Tracepoints",": Hooks within the Linux kernel where eBPF programs can be attached to monitor specific events like system calls.",[240,9769,9770,9773],{},[155,9771,9772],{},"Probes (kprobes and uprobes)",": Tools that let you attach eBPF programs to kernel or user-space functions to trace events as they happen.",[240,9775,9776,9779],{},[155,9777,9778],{},"Helpers",": Special kernel functions that eBPF programs can call to interact with system elements safely and efficiently.",[1179,9781,9783],{"id":9782},"ebpf-programs","eBPF Programs",[12,9785,9786],{},"So, how does eBPF actually operate? It starts with small, efficient programs typically written in C, which are then compiled into a specialized bytecode. This bytecode is loaded into the kernel, attaching to key system events like a packet entering the network or a system call being made. Once the event occurs, the eBPF program springs into action.",[12,9788,9789],{},"Before an eBPF program runs in the kernel, it is validated by the \"verifier,\" a built-in mechanism that ensures the program is safe to execute. Once verified, the program can run in real time, performing its task without impacting system performance. It’s like adding new functionality to the system, in real-time, without any risk of crashes or inefficiency.",[12,9791,9792],{},[179,9793],{"alt":9794,"src":9795},"Bcc Tracing Tools 2019.png","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.10.01.what.is\u002F4433509d-34d9-4b53-8c3c-8e571db43104.jpg",[73,9797,9799],{"id":9798},"benefits-of-ebpf","Benefits of eBPF",[12,9801,9802,9803,9808,9809,9812],{},"What makes eBPF so powerful is its ability to provide in-depth system insights without interfering with performance. By running within the kernel, eBPF can hook into nearly ",[731,9804,9807],{"href":9805,"rel":9806},"https:\u002F\u002Fgithub.com\u002Fiovisor\u002Fbcc#tools",[735],"every part of the system",", allowing teams to see what's happening in real-time, from ",[731,9810,9811],{"href":7471},"monitoring network traffic"," to tracing application behavior.",[12,9814,9815],{},"It’s also incredibly flexible. You can trace network packets, enforce security policies, and even modify system behavior in real time. And it’s all safe thanks to its sandboxing and verification steps.",[73,9817,9819],{"id":9818},"ebpf-use-case-examples","eBPF Use Case Examples",[12,9821,9822],{},"The flexibility of eBPF has made it essential for a wide range of use cases:",[237,9824,9825,9831,9837],{},[240,9826,9827,9830],{},[155,9828,9829],{},"Networking",": eBPF started in network filtering and remains one of the best tools for monitoring packet flows, analyzing traffic, and even implementing load balancing or DDoS protection with minimal performance impact.",[240,9832,9833,9836],{},[155,9834,9835],{},"System Monitoring",": Tools like bcc and bpftrace use eBPF to provide real-time system insights—whether it’s CPU usage, memory access, or disk I\u002FO patterns.",[240,9838,9839,9842],{},[155,9840,9841],{},"Security",": eBPF can monitor for unusual system calls or suspicious network activity, helping detect and stop potential security threats before they escalate.",[12,9844,9845,9848],{},[155,9846,9847],{},"Container Monitoring",": In containerized environments like Kubernetes, eBPF can offer detailed monitoring of traffic flows, resource usage, and application performance, helping ensure smooth operations.",[73,9850,9852],{"id":9851},"qpoint-and-ebpf","Qpoint and eBPF",[12,9854,9855,9856,9859],{},"Enter ",[731,9857,3325],{"href":9858},"\u002F#use-cases",". As modern applications increasingly depend on external services, monitoring and securing the flow of data between your systems and their external dependencies has become crucial. This is another area where eBPF truly shines—providing the ability to track external API calls, inspect payloads, and detect errors in real-time.",[12,9861,9862],{},"With eBPF, you can capture data at the kernel level, offering unprecedented visibility into unencrypted payloads and insights into how your applications interact with external systems. This includes detecting errors or anomalous behavior early to avoid outages, troubleshooting external service issues faster, and even reducing cloud costs by analyzing traffic patterns. eBPF allows all of this to happen without any modification to your application code, maintaining system performance while providing the deep insights you need to optimize your operations.",[73,9864,4834],{"id":4833},[12,9866,9867],{},"In the fast-evolving world of Linux observability, performance tuning, and security, eBPF is a powerful tool that unlocks unparalleled access to what’s happening inside your system. Whether you’re a developer, an operator, or a security professional, eBPF provides the versatility, safety, and efficiency needed to keep modern systems running smoothly and securely.",[12,9869,9870,9872],{},[731,9871,3387],{"href":1311}," with a Qpoint solution engineer today, to see how eBPF can be a game changer for your highly connected production applications.",{"title":184,"searchDepth":185,"depth":185,"links":9874},[9875,9876,9877,9878,9879,9880],{"id":9735,"depth":191,"text":9736},{"id":9745,"depth":191,"text":9746},{"id":9798,"depth":191,"text":9799},{"id":9818,"depth":191,"text":9819},{"id":9851,"depth":191,"text":9852},{"id":4833,"depth":191,"text":4834},"2024-10-01","Understand how eBPF technology works, its key use cases, and how it empowers teams to optimize application performance, enhance security, and troubleshoot faster.","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.10.01.what.is\u002Febpf.svg",{},{"title":9723,"description":9882},"what-is-ebpf","blog\u002Fwhat-is-ebpf","AFVjzIz3kXYvpFLZ1WqKvO_v8qIY1D3GjXUFNszZ7bQ",{"id":9890,"title":9891,"author":7,"body":9892,"date":10502,"description":10503,"excerpt":197,"extension":198,"eyebrow":10504,"heroImage":10505,"heroImageClasses":197,"heroShadow":202,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":10506,"logoColor":3614,"maxImgWidth":197,"meta":10507,"navigation":201,"path":10508,"seo":10509,"slug":10510,"stem":10511,"subHeadline":10512,"tags":197,"__hash__":10513},"blog\u002Fblog\u002Fwhat-your-ai-assistant-cant-see.md","What Your AI Assistant Can't See (And How to Fix It)",{"type":9,"value":9893,"toc":10491},[9894,9901,9907,9910,9912,9916,9919,9925,9934,9938,9941,9944,9949,9973,9976,9978,9982,9985,9988,9991,9993,9997,10000,10003,10007,10010,10016,10019,10021,10025,10028,10031,10034,10037,10043,10046,10052,10055,10058,10118,10121,10123,10127,10130,10136,10142,10148,10154,10156,10160,10163,10169,10174,10180,10183,10186,10192,10195,10197,10201,10204,10210,10216,10222,10228,10231,10233,10235,10238,10243,10270,10275,10319,10331,10366,10371,10429,10434,10440,10455,10457,10461,10464,10467,10470,10472,10488],[12,9895,9896,9897,9900],{},"When your Stripe integration fails at 2am, Claude or Copilot can read your SDK calls, trace your error handling logic, and even suggest fixes based on the documentation. What it can't do is see the ",[284,9898,9899],{},"401 Unauthorized"," response that Stripe is actually returning, or notice that you're accidentally sending the test API key to production.",[12,9902,9903,9904,9906],{},"This blind spot is a data access problem. Your AI assistant lives in a world of static code and documentation. The live network traffic that would tell it ",[250,9905,252],{}," what's going wrong? Invisible.",[12,9908,9909],{},"Until you give it eyes.",[16,9911],{},[29,9913,9915],{"id":9914},"the-debugging-gap","The Debugging Gap",[12,9917,9918],{},"Consider a typical debugging session with an AI assistant:",[12,9920,9921,9924],{},[155,9922,9923],{},"You:"," \"My payment integration is failing. Here's the code.\"",[12,9926,9927,351,9930,9933],{},[155,9928,9929],{},"AI:",[250,9931,9932],{},"reads your code"," \"Your implementation looks correct. The error handling follows best practices. Have you verified your API keys are set correctly? Here are some things to check...\"",[179,9935],{"alt":8700,"className":9936,"src":9937},[8702,5309,8703],"\u002Fimages\u002F2026.Q1\u002F2026.02.04.ai-assistant-phone.png",[12,9939,9940],{},"This is helpful, but it's educated guessing. The AI is reasoning from code structure and documentation, disconnected from what's actually happening when your code runs.",[12,9942,9943],{},"Now imagine the same session with network visibility:",[12,9945,9946,9948],{},[155,9947,9923],{}," \"My payment integration is failing.\"",[12,9950,9951,351,9953,9956,9957,9960,9961,9964,9965,9968,9969,9972],{},[155,9952,9929],{},[250,9954,9955],{},"captures live traffic"," \"I can see the issue. Your app is sending ",[284,9958,9959],{},"POST \u002Fv1\u002Fcharges"," to Stripe, but getting back ",[284,9962,9963],{},"402 Payment Required"," with the response: ",[284,9966,9967],{},"{error: {code: 'card_declined', decline_code: 'insufficient_funds'}}",". The test card you're using simulates a declined payment. Try card number ",[284,9970,9971],{},"4242424242424242"," instead.\"",[12,9974,9975],{},"Same question. Radically different answer. The difference is access to ground truth.",[16,9977],{},[29,9979,9981],{"id":9980},"giving-ai-eyes-on-the-network","Giving AI Eyes on the Network",[12,9983,9984],{},"Qpoint builds tools for network visibility. Our open-source agent, Qtap, uses eBPF to capture HTTP traffic directly from the Linux kernel, before TLS encryption happens. No proxies to configure, no certificates to manage, no code changes required. You run Qtap on a host, and it sees every HTTP request and response made by every process on that machine.",[12,9986,9987],{},"Qtap DevTools is a feature we built for real-time debugging: a browser-based interface showing live HTTP traffic as it flows, complete with headers, bodies, timing, and the exact process or container that made each request. Think Chrome DevTools for your server's network activity.",[12,9989,9990],{},"DevTools also exposes a streaming API. Any tool that can consume Server-Sent Events can subscribe to the traffic stream and build on top of it. Which brings us to MCP.",[16,9992],{},[29,9994,9996],{"id":9995},"connecting-ai-to-live-traffic-with-mcp","Connecting AI to Live Traffic with MCP",[12,9998,9999],{},"The Model Context Protocol (MCP) is an open standard that lets AI assistants connect to external data sources through defined tool interfaces. Instead of just reading files, an AI with MCP can query databases, call APIs, or subscribe to event streams.",[12,10001,10002],{},"We built an MCP server that connects AI assistants to DevTools. When you wire it up to Claude Code, Codex CLI, or ChatGPT, your AI gains the ability to capture and analyze live network traffic on demand.",[179,10004],{"alt":8700,"className":10005,"src":10006},[8702,5309,8703],"\u002Fimages\u002F2026.Q1\u002F2026.02.04.ai-assistant-phone-a-friend.png",[12,10008,10009],{},"Here's what that looks like in practice:",[1546,10011,10014],{"className":10012,"code":10013,"language":1551},[1549],"You: \"What external APIs is my app calling?\"\n\nClaude: [Calling get_hosts tool...]\n\"Your application is connecting to 16 external services:\n- api.stripe.com (23 requests, all 200s)\n- api.openai.com (12 requests, 3 returned 429 rate limit errors)\n- hooks.slack.com (8 requests)\n- api.segment.io (47 requests)\n...\"\n",[284,10015,10013],{"__ignoreMap":184},[12,10017,10018],{},"The AI watched your actual traffic and reported exactly what's happening, including the rate limit errors you didn't know about.",[16,10020],{},[29,10022,10024],{"id":10023},"making-it-fast-enough-for-production","Making It Fast Enough for Production",[12,10026,10027],{},"The naive approach to AI traffic analysis would be: capture everything, send it all to the AI, let it figure out what's relevant.",[12,10029,10030],{},"This works fine in a demo. In production, it falls apart.",[12,10032,10033],{},"A busy microservices environment generates thousands of HTTP transactions per minute. Streaming all of that to an MCP server means bandwidth overload, context window limits, and latency that defeats the purpose during an active incident.",[12,10035,10036],{},"The solution is server-side filtering. Instead of capturing everything and filtering later, you tell Qtap exactly what you want at the kernel level:",[1546,10038,10041],{"className":10039,"code":10040,"language":1551},[1549],"# Without server-side filtering\nDevTools API → All Events (1000s) → MCP Server → Filter → AI\n                                     (decode all)  (discard most)\n\n# With server-side filtering\nDevTools API + Filter → Matching Events (10s) → MCP Server → AI\n                          (pre-filtered)          (decode matches)\n",[284,10042,10040],{"__ignoreMap":184},[12,10044,10045],{},"When you ask \"What errors are happening in the payment service?\", the MCP server sends this filter expression to Qtap:",[1546,10047,10050],{"className":10048,"code":10049,"language":1551},[1549],"res.status >= 400 AND container.name == \"payment-service\"\n",[284,10051,10049],{"__ignoreMap":184},[12,10053,10054],{},"Qtap applies this filter at the kernel level, before events ever leave the host. Your AI receives only the matching transactions, typically dozens when you might otherwise have thousands. The response comes back in seconds.",[12,10056,10057],{},"The filter language supports the fields you'd expect: HTTP method, status code, host, path, request direction, plus process and container metadata. You can combine conditions with AND\u002FOR logic. A few examples:",[10059,10060,10061,10074],"table",{},[10062,10063,10064],"thead",{},[10065,10066,10067,10071],"tr",{},[10068,10069,10070],"th",{},"Goal",[10068,10072,10073],{},"Filter Expression",[10075,10076,10077,10088,10098,10108],"tbody",{},[10065,10078,10079,10083],{},[10080,10081,10082],"td",{},"All errors",[10080,10084,10085],{},[284,10086,10087],{},"res.status >= 400",[10065,10089,10090,10093],{},[10080,10091,10092],{},"Errors from a specific container",[10080,10094,10095],{},[284,10096,10097],{},"res.status >= 400 AND container.name == \"payment-service\"",[10065,10099,10100,10103],{},[10080,10101,10102],{},"External API calls only",[10080,10104,10105],{},[284,10106,10107],{},"direction == \"egress-external\"",[10065,10109,10110,10113],{},[10080,10111,10112],{},"POST requests to Stripe",[10080,10114,10115],{},[284,10116,10117],{},"req.method == \"POST\" AND req.host == \"api.stripe.com\"",[12,10119,10120],{},"This filtering happens before the data hits your MCP server, which means you can run AI-assisted debugging against high-traffic production systems without drowning in data.",[16,10122],{},[29,10124,10126],{"id":10125},"building-blocks-for-different-problems","Building Blocks for Different Problems",[12,10128,10129],{},"The combination of DevTools, MCP, and server-side filtering gives you building blocks that can be assembled for different use cases.",[12,10131,10132,10135],{},[155,10133,10134],{},"Real-time debugging"," is the most obvious. When something breaks, you ask your AI what's happening, it captures filtered traffic, and tells you what it sees. No log correlation, no manual inspection, no context switching.",[12,10137,10138,10141],{},[155,10139,10140],{},"Security auditing"," becomes conversational. Instead of writing scripts to scan for credential leakage, you ask: \"Are we sending any sensitive data to external services?\" The MCP server captures traffic, scans for patterns like API keys, passwords, and tokens, and reports what it finds along with which process sent it and where it went.",[12,10143,10144,10147],{},[155,10145,10146],{},"Incident response"," gets faster. During an outage, you can ask \"What changed in the last hour?\" and get a comparison of traffic patterns, new error types, or API endpoints that started failing. The AI has access to the same ground truth your network has, so it can give you specific, actionable answers.",[12,10149,10150,10153],{},[155,10151,10152],{},"Dependency discovery"," happens automatically. \"What external services does this container talk to?\" becomes a question you can answer in seconds, with actual traffic data backing up the answer.",[16,10155],{},[29,10157,10159],{"id":10158},"what-this-looks-like-in-practice","What This Looks Like in Practice",[12,10161,10162],{},"Let's walk through a concrete example. Your on-call engineer gets paged: payment failures are spiking.",[12,10164,10165,10168],{},[155,10166,10167],{},"Traditional approach:"," SSH into the box, tail logs, grep for errors, correlate timestamps, manually inspect payloads, form hypotheses, repeat.",[12,10170,10171],{},[155,10172,10173],{},"With AI-assisted debugging:",[1546,10175,10178],{"className":10176,"code":10177,"language":1551},[1549],"You: \"What's failing in the payment service right now?\"\n\nClaude: [Calling get_errors_by_container(\"payment-service\")]\n\"Found 47 errors in payment-service over the last 60 seconds:\n\n1. POST \u002Fv1\u002Fcharges → 500 Internal Server Error (31 occurrences)\n   Response: {\"error\": {\"type\": \"api_error\", \"message\": \"Request timed out\"}}\n\n2. POST \u002Fv1\u002Fcharges → 402 Payment Required (12 occurrences)\n   Response: {\"error\": {\"code\": \"card_declined\"}}\n\n3. GET \u002Fv1\u002Fcustomers\u002Fcus_xxx → 404 Not Found (4 occurrences)\n\nThe 500s suggest Stripe is experiencing latency—checking their status page\nwould confirm. The 402s are expected business logic (declined cards).\nThe 404s might indicate stale customer IDs in your cache.\"\n",[284,10179,10177],{"__ignoreMap":184},[12,10181,10182],{},"Time to diagnosis: under a minute. The AI captured the relevant traffic, categorized the errors, showed you the actual response bodies, and offered reasonable hypotheses.",[12,10184,10185],{},"Another scenario: your security team wants to audit what sensitive data is being sent to external APIs.",[1546,10187,10190],{"className":10188,"code":10189,"language":1551},[1549],"You: \"Check for sensitive data in our external API calls\"\n\nClaude: [Calling check_sensitive_data()]\n\"Found 3 requests with potentially sensitive data:\n\n1. POST api.analytics.io\u002Fv1\u002Ftrack\n   - 'password' field in request body containing cleartext password\n   - Source: container 'user-service', process '\u002Fapp\u002Fserver'\n\n2. POST api.openai.com\u002Fv1\u002Fchat\u002Fcompletions\n   - API key pattern detected in prompt text: 'sk-proj-xxxxx'\n   - Source: container 'ai-assistant', process 'python3'\n\n3. GET legacy-api.internal\u002Fusers\n   - SSN pattern in response body: '123-45-6789'\n   - Source: container 'reporting-service'\n\nRecommendations:\n- #1: Your analytics tracking is capturing user passwords—audit what fields you're sending\n- #2: An API key is being included in prompts to OpenAI—check your prompt construction\n- #3: The legacy API is returning unmasked SSNs—consider data masking\"\n",[284,10191,10189],{"__ignoreMap":184},[12,10193,10194],{},"The AI captured external traffic, scanned for sensitive patterns, identified the source containers, and explained the implications. An expert analyst who can see inside encrypted traffic, understands what patterns matter, and works on demand.",[16,10196],{},[29,10198,10200],{"id":10199},"the-technical-foundation","The Technical Foundation",[12,10202,10203],{},"All of this relies on eBPF-based traffic capture. Qtap instruments the Linux kernel to observe network traffic before TLS encryption, which means:",[12,10205,10206,10209],{},[155,10207,10208],{},"Complete visibility",": The AI sees every HTTP transaction, including ones that never make it to your application logs. Failed requests, timeouts, malformed responses—everything.",[12,10211,10212,10215],{},[155,10213,10214],{},"Process attribution",": Every request is tagged with the exact process, container, and pod that made it. When the AI reports an issue, it can tell you exactly which component is responsible.",[12,10217,10218,10221],{},[155,10219,10220],{},"Zero overhead",": eBPF runs in a kernel sandbox with strict safety guarantees. The Linux kernel verifies every eBPF program before execution, ensuring it can't crash your system or access unauthorized memory. Safe to run during production incidents.",[12,10223,10224,10227],{},[155,10225,10226],{},"No blind spots",": Works for any language, any framework, any HTTP client library. If it makes an HTTP request on that host, Qtap sees it.",[12,10229,10230],{},"When you combine kernel-level visibility with server-side filtering and AI analysis, you get conversational debugging of live production traffic.",[16,10232],{},[29,10234,5407],{"id":5406},[12,10236,10237],{},"The setup takes about 10 minutes.",[12,10239,10240],{},[155,10241,10242],{},"1. Install Qtap with DevTools enabled:",[1546,10244,10246],{"className":5413,"code":10245,"language":5415,"meta":184,"style":184},"curl -s https:\u002F\u002Fget.qpoint.io\u002Finstall | sudo sh\nsudo qtap --enable-dev-tools\n",[284,10247,10248,10262],{"__ignoreMap":184},[1903,10249,10250,10252,10254,10256,10258,10260],{"class":1905,"line":1906},[1903,10251,286],{"class":3757},[1903,10253,5429],{"class":1983},[1903,10255,5432],{"class":2541},[1903,10257,5435],{"class":1915},[1903,10259,5438],{"class":3757},[1903,10261,5441],{"class":2541},[1903,10263,10264,10266,10268],{"class":1905,"line":185},[1903,10265,5455],{"class":3757},[1903,10267,5458],{"class":2541},[1903,10269,5461],{"class":1983},[12,10271,10272],{},[155,10273,10274],{},"2. Verify DevTools is running:",[1546,10276,10278],{"className":5413,"code":10277,"language":5415,"meta":184,"style":184},"# You should see a stream of events\ncurl -sN http:\u002F\u002Flocalhost:10001\u002Fdevtools\u002Fapi\u002Fevents | head -5\n\n# Or open the browser UI\nopen http:\u002F\u002Flocalhost:10001\u002Fdevtools\n",[284,10279,10280,10285,10303,10307,10312],{"__ignoreMap":184},[1903,10281,10282],{"class":1905,"line":1906},[1903,10283,10284],{"class":1909},"# You should see a stream of events\n",[1903,10286,10287,10289,10292,10295,10297,10300],{"class":1905,"line":185},[1903,10288,286],{"class":3757},[1903,10290,10291],{"class":1983}," -sN",[1903,10293,10294],{"class":2541}," http:\u002F\u002Flocalhost:10001\u002Fdevtools\u002Fapi\u002Fevents",[1903,10296,5435],{"class":1915},[1903,10298,10299],{"class":3757}," head",[1903,10301,10302],{"class":1983}," -5\n",[1903,10304,10305],{"class":1905,"line":191},[1903,10306,2120],{"emptyLinePlaceholder":201},[1903,10308,10309],{"class":1905,"line":1956},[1903,10310,10311],{"class":1909},"# Or open the browser UI\n",[1903,10313,10314,10316],{"class":1905,"line":1965},[1903,10315,2536],{"class":3757},[1903,10317,10318],{"class":2541}," http:\u002F\u002Flocalhost:10001\u002Fdevtools\n",[12,10320,10321,10324,10325,10330],{},[155,10322,10323],{},"3. Set up the MCP server"," (full code in our ",[731,10326,10329],{"href":10327,"rel":10328},"https:\u002F\u002Fdocs.qpoint.io\u002Fguides\u002Fdevtools-guides\u002Fdevtools-mcp-server",[735],"DevTools MCP guide","):",[1546,10332,10334],{"className":5413,"code":10333,"language":5415,"meta":184,"style":184},"pip install mcp httpx\n# Download devtools_mcp.py from the guide\nchmod +x devtools_mcp.py\n",[284,10335,10336,10350,10355],{"__ignoreMap":184},[1903,10337,10338,10341,10344,10347],{"class":1905,"line":1906},[1903,10339,10340],{"class":3757},"pip",[1903,10342,10343],{"class":2541}," install",[1903,10345,10346],{"class":2541}," mcp",[1903,10348,10349],{"class":2541}," httpx\n",[1903,10351,10352],{"class":1905,"line":185},[1903,10353,10354],{"class":1909},"# Download devtools_mcp.py from the guide\n",[1903,10356,10357,10360,10363],{"class":1905,"line":191},[1903,10358,10359],{"class":3757},"chmod",[1903,10361,10362],{"class":2541}," +x",[1903,10364,10365],{"class":2541}," devtools_mcp.py\n",[12,10367,10368],{},[155,10369,10370],{},"4. Connect to your AI assistant:",[1546,10372,10374],{"className":5413,"code":10373,"language":5415,"meta":184,"style":184},"# Claude Code\nclaude mcp add devtools -- python3 \u002Fpath\u002Fto\u002Fdevtools_mcp.py\n\n# Codex CLI\ncodex mcp add devtools -- python3 \u002Fpath\u002Fto\u002Fdevtools_mcp.py\n",[284,10375,10376,10381,10403,10407,10412],{"__ignoreMap":184},[1903,10377,10378],{"class":1905,"line":1906},[1903,10379,10380],{"class":1909},"# Claude Code\n",[1903,10382,10383,10386,10388,10391,10394,10397,10400],{"class":1905,"line":185},[1903,10384,10385],{"class":3757},"claude",[1903,10387,10346],{"class":2541},[1903,10389,10390],{"class":2541}," add",[1903,10392,10393],{"class":2541}," devtools",[1903,10395,10396],{"class":1983}," --",[1903,10398,10399],{"class":2541}," python3",[1903,10401,10402],{"class":2541}," \u002Fpath\u002Fto\u002Fdevtools_mcp.py\n",[1903,10404,10405],{"class":1905,"line":191},[1903,10406,2120],{"emptyLinePlaceholder":201},[1903,10408,10409],{"class":1905,"line":1956},[1903,10410,10411],{"class":1909},"# Codex CLI\n",[1903,10413,10414,10417,10419,10421,10423,10425,10427],{"class":1905,"line":1965},[1903,10415,10416],{"class":3757},"codex",[1903,10418,10346],{"class":2541},[1903,10420,10390],{"class":2541},[1903,10422,10393],{"class":2541},[1903,10424,10396],{"class":1983},[1903,10426,10399],{"class":2541},[1903,10428,10402],{"class":2541},[12,10430,10431],{},[155,10432,10433],{},"5. Start debugging:",[1546,10435,10438],{"className":10436,"code":10437,"language":1551},[1549],"You: \"What's happening with my network traffic?\"\n",[284,10439,10437],{"__ignoreMap":184},[12,10441,10442,10443,10448,10449,10454],{},"For high-traffic environments, use our ",[731,10444,10447],{"href":10445,"rel":10446},"https:\u002F\u002Fdocs.qpoint.io\u002Fguides\u002Fdevtools-guides\u002Fenhanced-mcp-troubleshooting",[735],"enhanced MCP server"," with server-side filtering. For local-only setups without external API dependencies, we have a ",[731,10450,10453],{"href":10451,"rel":10452},"https:\u002F\u002Fdocs.qpoint.io\u002Fguides\u002Fdevtools-guides\u002Fai-troubleshooting-with-devtools",[735],"guide for running with Ollama"," and local models like Qwen.",[16,10456],{},[29,10458,10460],{"id":10459},"closing-the-gap","Closing the Gap",[12,10462,10463],{},"AI coding assistants are getting remarkably good at understanding and generating code. But code understanding is only half the picture. The other half is runtime understanding: knowing what your code is actually doing when it runs.",[12,10465,10466],{},"Logs capture what your application decides to record. Metrics capture what you decide to measure. Network traffic captures everything, whether you planned for it or not.",[12,10468,10469],{},"By giving AI assistants access to that traffic, filtered efficiently and analyzed intelligently, we move from educated guessing to actual understanding. The gap between \"your code looks correct\" and \"I can see exactly what's failing\" is the gap between a suggestion and a solution.",[16,10471],{},[12,10473,10474],{},[250,10475,10476,10478,10479,10482,10483,10487],{},[731,10477,3325],{"href":4155}," builds tools for network visibility. ",[731,10480,3329],{"href":5496,"rel":10481},[735]," is our open-source eBPF agent for capturing HTTP traffic. DevTools is included in Qtap for real-time debugging. ",[731,10484,10486],{"href":5490,"rel":10485},[735],"Get started"," in 5 minutes.",[3390,10489,10490],{},"html pre.shiki code .sYc7l, html code.shiki .sYc7l{--shiki-default:#FFA657;--shiki-light:#6F42C1;--shiki-dark:#FFA657}html pre.shiki code .sCeZ-, html code.shiki .sCeZ-{--shiki-default:#79C0FF;--shiki-light:#005CC5;--shiki-dark:#79C0FF}html pre.shiki code .sIrxU, html code.shiki .sIrxU{--shiki-default:#A5D6FF;--shiki-light:#032F62;--shiki-dark:#A5D6FF}html pre.shiki code .sLAjK, html code.shiki .sLAjK{--shiki-default:#FF7B72;--shiki-light:#D73A49;--shiki-dark:#FF7B72}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .soxxa, html code.shiki .soxxa{--shiki-default:#8B949E;--shiki-light:#6A737D;--shiki-dark:#8B949E}",{"title":184,"searchDepth":185,"depth":185,"links":10492},[10493,10494,10495,10496,10497,10498,10499,10500,10501],{"id":9914,"depth":185,"text":9915},{"id":9980,"depth":185,"text":9981},{"id":9995,"depth":185,"text":9996},{"id":10023,"depth":185,"text":10024},{"id":10125,"depth":185,"text":10126},{"id":10158,"depth":185,"text":10159},{"id":10199,"depth":185,"text":10200},{"id":5406,"depth":185,"text":5407},{"id":10459,"depth":185,"text":10460},"2026-01-22","Your AI coding assistant can read every line of your code. But when that code makes an HTTP request, your AI has no idea what comes back. Here's how to give it eyes on live network traffic.","AI + Network Visibility","\u002Fimages\u002F2026.Q1\u002F2026.02.04.ai-assistant-1.png","\u002Fimages\u002F2026.Q1\u002F2026.02.04.ai-assistant-listing.1.png",{},"\u002Fblog\u002Fwhat-your-ai-assistant-cant-see",{"title":9891,"description":10503},"what-your-ai-assistant-cant-see","blog\u002Fwhat-your-ai-assistant-cant-see","Your AI coding assistant can read every line of your code. But when that code makes an HTTP request, your AI has no idea what comes back.","_GOg_Od6OMsjIUbXH2kO1z6zpQyg-k4NirSOnpYPaow",{"id":10515,"title":10516,"author":5565,"body":10517,"date":10650,"description":10651,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":9243,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":10652,"navigation":201,"path":8021,"seo":10653,"slug":10654,"stem":10655,"subHeadline":10656,"tags":197,"__hash__":10657},"blog\u002Fblog\u002Fwhats-the-difference-between-my-apm-tool-and-qpoint.md","What's the difference between my APM tool and eBPF-powered QPoint?",{"type":9,"value":10518,"toc":10641},[10519,10522,10525,10531,10540,10546,10551,10554,10568,10571,10577,10583,10586,10592,10595,10601,10607,10614,10618,10621,10627,10634],[12,10520,10521],{},"In today's hyper-connected world, production applications depend on external services and APIs to deliver those must-have features. This setup boosts innovation and speeds up time-to-market, but it also brings unexpected operational headaches and security risks that can disrupt reliability and lead to significant downtime and performance issues. While typical APM tools cover general observability, Qpoint zeroes in on external service dependencies, offering unmatched visibility and control with cutting-edge, eBPF technology.",[12,10523,10524],{},"Here’s how Qpoint stands out:",[73,10526,10528],{"id":10527},"tailored-for-external-integrations",[155,10529,10530],{},"Tailored for External Integrations",[12,10532,10533,10534,10536,10537,221],{},"Unlike a standard APM tool, ",[731,10535,3325],{"href":4155}," is purpose built to monitor and secure external service integrations and traffic flows, providing deeper insights and superior control capabilities. If your platform has a growing number of critical external dependencies, this has a major impact on your team's ability to prevent or drastically ",[731,10538,10539],{"href":9858},"reduce the impact of a vendor caused outage",[73,10541,10543],{"id":10542},"ebpf-powered-with-full-payload-access",[155,10544,10545],{},"eBPF-Powered with Full Payload Access",[12,10547,7970,10548,10550],{},[731,10549,1221],{"href":7782}," to deliver unparalleled visibility and control at the kernel level without impacting system performance. Unlike traditional monitoring approaches and APM tools, eBPF allows Qpoint to capture and inspect encrypted traffic payloads directly within the Linux kernel. This provides invaluable insights for audit logging, debugging, and analysis—allowing teams to not only trace external service interactions but also see the actual content of those interactions.",[12,10552,10553],{},"By accessing the full, unencrypted payload, Qpoint can enable superior:",[237,10555,10556,10562],{},[240,10557,10558,10561],{},[155,10559,10560],{},"Audit Logging:"," Capture detailed records of external service interactions for compliance and accountability, ensuring you can track every request and response.",[240,10563,10564,10567],{},[155,10565,10566],{},"Debugging and Root Cause Analysis:"," Gain deeper insights into issues by seeing exactly what data was sent and received between applications and third-party services, accelerating troubleshooting and pinpointing failures faster.",[12,10569,10570],{},"This level of visibility, combined with the performance efficiency of eBPF sets Qpoint apart from traditional monitoring tools which cannot provide full payload inspection and may introduce significant system overhead.",[12,10572,10573],{},[179,10574],{"alt":10575,"src":10576},"Audit Loggin@3x","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.09.26.what's.the\u002Fe0482dd9-35df-494e-99b1-78af93be00a4.webp",[73,10578,10580],{"id":10579},"data-tagging-and-custom-filters",[155,10581,10582],{},"Data Tagging and Custom Filters",[12,10584,10585],{},"Qpoint’s advanced middleware subsystem lets you set custom tags on each interaction, providing granular filtering for reports and recorded data. This enables more precise debugging sessions and allows you to track bandwidth usage, errors, rate limits, and customer-specific metrics, offering deeper insights than APM solutions.",[73,10587,10589],{"id":10588},"api-token-management",[155,10590,10591],{},"API Token Management",[12,10593,10594],{},"Qpoint tracks API token usage across external services, allowing for better management of API traffic and rate limits, a feature lacking in APM tools.",[12,10596,10597],{},[179,10598],{"alt":10599,"src":10600},"API Tokens","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.09.26.what's.the\u002Fdb8624bb-64eb-4dca-a56d-84970ba5e3d8.webp",[73,10602,10604],{"id":10603},"granular-vendor-monitoring-and-security-audit-trail",[155,10605,10606],{},"Granular Vendor Monitoring and Security Audit Trail",[12,10608,10609,10610,10613],{},"Qpoint enables ",[731,10611,10612],{"href":6279},"detailed monitoring"," of specific vendor interactions, making it a more effective tool to troubleshoot issues with external services. This capability can also help to provide clear evidence of SLA violations to ensure vendor accountability. Generalized observability and APM tools do not provide this level of granularity.",[73,10615,10617],{"id":10616},"cloud-bandwidth-cost-attribution","Cloud Bandwidth & Cost Attribution",[12,10619,10620],{},"Qpoint allows businesses to attribute bandwidth usage and cloud costs related to egress traffic and external service usage back to the relevant applications and teams. This can help to optimize cloud spend and is a distinct advantage over APM tools which do not focus on this area.",[73,10622,10624],{"id":10623},"gain-better-insight-into-applications-with-ebpf",[155,10625,10626],{},"Gain Better Insight Into Applications with eBPF",[12,10628,10629,10630,10633],{},"Qpoint is ",[155,10631,10632],{},"purpose-built"," for monitoring and securing your applications' external service dependencies and traffic flows. With eBPF-powered insights into encrypted traffic at the kernel level, Qpoint gives you next-level audit logging, debugging, and root cause analysis. Custom tagging, API token tracking, and granular vendor monitoring arm your ops team with the tools they need to boost reliability, reduce vendor-related risks, and keep cloud costs in check—delivering more precision than a standard APM tool.",[12,10635,10636,10637,10640],{},"Ready to take control of your external integrations and keep your production applications running smoothly? ",[731,10638,10639],{"href":1311},"Book a demo"," and discover what Qpoint can do for your ops team today!",{"title":184,"searchDepth":185,"depth":185,"links":10642},[10643,10644,10645,10646,10647,10648,10649],{"id":10527,"depth":191,"text":10530},{"id":10542,"depth":191,"text":10545},{"id":10579,"depth":191,"text":10582},{"id":10588,"depth":191,"text":10591},{"id":10603,"depth":191,"text":10606},{"id":10616,"depth":191,"text":10617},{"id":10623,"depth":191,"text":10626},"2024-09-26","Qpoint is purpose-built to monitor & secure applications' external dependencies and traffic flows for smooth operations and protection against hidden outage risks.",{},{"title":10516,"description":10651},"whats-the-difference-between-my-apm-tool-and-qpoint","blog\u002Fwhats-the-difference-between-my-apm-tool-and-qpoint","Qpoint is purpose-built to monitor and secure your applications' external dependencies and traffic flows, ensuring smooth operations and protecting against hidden risks that can lead to costly outages.","kgIir5OMrF0OeeSk_uKBne6y72QK9l-5G4UvPGCfglQ",{"id":10659,"title":10660,"author":599,"body":10661,"date":11085,"description":11086,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":11087,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":201,"listingImage":11088,"logoColor":197,"maxImgWidth":197,"meta":11089,"navigation":201,"path":11090,"seo":11091,"slug":11092,"stem":11093,"subHeadline":11086,"tags":197,"__hash__":11094},"blog\u002Fblog\u002Fwhy-running-qtap-in-production-is-safe.md","Why Running Qtap in Production is Safe - A Deep Dive into eBPF and Privilege Boundaries",{"type":9,"value":10662,"toc":11060},[10663,10669,10672,10676,10679,10693,10696,10700,10703,10719,10722,10729,10735,10738,10744,10748,10751,10765,10768,10774,10780,10784,10792,10796,10799,10802,10806,10809,10829,10833,10842,10846,10857,10861,10871,10875,10885,10889,10899,10903,10906,10910,10916,10920,10926,10930,10936,10940,10946,10950,10953,10979,10982,10986,10989,11018,11020,11023,11026,11031,11033,11038],[12,10664,10665,10666,10668],{},"Let's address the elephant in the room. After recent high-profile kernel agent failures that took down millions of systems worldwide, your security and operations teams are rightfully cautious about ",[250,10667,5283],{}," that touches the kernel. When we tell you that Qtap needs elevated privileges and deploys eBPF programs into kernel space, we understand the skepticism.",[12,10670,10671],{},"So let's talk about what actually happens when you run Qtap, why eBPF is fundamentally different from traditional kernel modules, and how we've architected our agent to fail safely even in worst-case scenarios.",[29,10673,10675],{"id":10674},"the-two-halves-of-qtap-kernel-and-userspace","The Two Halves of Qtap: Kernel and Userspace",[12,10677,10678],{},"First, let's clarify what Qtap actually is. It's not a monolithic kernel module like the ones that have caused industry-wide outages. Instead, Qtap consists of two distinct components that operate in different security domains:",[267,10680,10681,10687],{},[240,10682,10683,10686],{},[155,10684,10685],{},"Small, verified eBPF programs"," that run in kernel space",[240,10688,10689,10692],{},[155,10690,10691],{},"A traditional userspace agent"," that processes and forwards data",[12,10694,10695],{},"This separation is crucial to understanding why Qtap is safe. Let me explain what happens in each domain.",[73,10697,10699],{"id":10698},"what-happens-in-kernel-space-the-ebpf-programs","What Happens in Kernel Space (The eBPF Programs)",[12,10701,10702],{},"Our eBPF programs are tiny, purpose-built observers. They do exactly three things:",[237,10704,10705,10713,10716],{},[240,10706,10707,10708,297,10710,10712],{},"Attach to TLS library functions (like OpenSSL's ",[284,10709,346],{},[284,10711,343],{},")",[240,10714,10715],{},"Copy small amounts of data into ring buffers",[240,10717,10718],{},"Attribute process actions to kernel events (like tcp socket creations)",[12,10720,10721],{},"That's it. No complex logic, no external API calls, no file system operations. Each program is small, focused, and in Qtap, read-only.",[12,10723,10724,10725,10728],{},"Here's the critical part: ",[155,10726,10727],{},"these programs cannot crash your kernel",". This isn't marketing speak; it's architecturally impossible. Before any eBPF program loads, the Linux kernel's verifier performs an exhaustive static analysis to ensure:",[1546,10730,10733],{"className":10731,"code":10732,"language":1551},[1549],"- Controlled total possible memory usage\n- Limited number of total program instructions\n- No infinite loops (all loops must have bounded iterations)\n- No out-of-bounds memory access\n- No invalid pointer dereferences  \n- No calling of unsafe kernel functions\n- Guaranteed program termination\n",[284,10734,10732],{"__ignoreMap":184},[12,10736,10737],{},"If our eBPF program fails any of these checks, it simply won't load. Your kernel remains untouched. This is fundamentally different from kernel modules, which have unrestricted access to kernel memory and can absolutely cause kernel panics if they misbehave.",[12,10739,10740,10743],{},[155,10741,10742],{},"This is a reminder to myself",": When customers ask \"what if your eBPF program crashes?\", the answer is: it can't crash in the traditional sense. The worst case is that it stops collecting data.",[73,10745,10747],{"id":10746},"what-happens-in-userspace-the-qtap-agent","What Happens in Userspace (The Qtap Agent)",[12,10749,10750],{},"The Qtap agent running in userspace is where all the complex logic lives. This is a regular Linux application, think of it like nginx, envoy, or any other service you run. It:",[237,10752,10753,10756,10759,10762],{},[240,10754,10755],{},"Reads data from eBPF ring buffers",[240,10757,10758],{},"Processes and enriches connection metadata",[240,10760,10761],{},"Manages local storage for payload data",[240,10763,10764],{},"Communicates with the Qpoint control plane (if configured)",[12,10766,10767],{},"Since this is a standard userspace application, you control it like any other service:",[1546,10769,10772],{"className":10770,"code":10771,"language":1551},[1549],"# In Kubernetes, you set resource limits just like any other pod\nresources:\n  limits:\n    memory: \"512Mi\"\n    cpu: \"500m\"\n  requests:\n    memory: \"256Mi\"\n    cpu: \"250m\"\n",[284,10773,10771],{"__ignoreMap":184},[12,10775,10776,10777,221],{},"If the userspace agent crashes, consumes too much memory, or hangs, it behaves exactly like any other application crash. Kubernetes will restart it, your monitoring will alert you, and most importantly, ",[155,10778,10779],{},"your kernel keeps running normally",[29,10781,10783],{"id":10782},"addressing-the-privilege-question","Addressing the Privilege Question",[12,10785,10786,10787,9232,10789,10791],{},"Yes, Qtap requires ",[284,10788,3042],{},[284,10790,4384],{}," capabilities to load eBPF programs. Let's be transparent about why and what this actually means for your security posture.",[73,10793,10795],{"id":10794},"why-we-need-these-privileges","Why We Need These Privileges",[12,10797,10798],{},"The privileges are required for exactly one operation: loading eBPF programs into the kernel. Once loaded, the programs themselves run with restricted capabilities; they can only perform the specific operations the verifier has approved.",[12,10800,10801],{},"Think of it this way: you need elevated privileges to install the security camera, but once installed, the camera can only observe, not interfere.",[73,10803,10805],{"id":10804},"limiting-the-blast-radius","Limiting the Blast Radius",[12,10807,10808],{},"Here's how we minimize risk from these elevated privileges:",[267,10810,10811,10817,10823],{},[240,10812,10813,10816],{},[155,10814,10815],{},"Container isolation",": When running in Kubernetes, Qtap runs in its own container with only the specific capabilities it needs.",[240,10818,10819,10822],{},[155,10820,10821],{},"Short-lived privilege use",": We only use elevated privileges during the initial eBPF program load and read the process filesystem. The ongoing data collection doesn't require these privileges.",[240,10824,10825,10828],{},[155,10826,10827],{},"No persistent kernel modifications",": Unlike kernel modules, eBPF programs are automatically unloaded when Qtap stops. There's no persistent change to your kernel.",[29,10830,10832],{"id":10831},"learning-from-crowdstrike-how-were-different","Learning from CrowdStrike: How We're Different",[12,10834,10835,10836,10841],{},"The ",[731,10837,10840],{"href":10838,"rel":10839},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002F2024_CrowdStrike-related_IT_outages",[735],"2024 CrowdStrike incident"," taught the industry valuable lessons about kernel-level agents. Here's how Qtap's architecture specifically addresses those failure modes:",[73,10843,10845],{"id":10844},"failure-mode-1-bad-updates","Failure Mode 1: Bad Updates",[12,10847,10848,10851,10852,10854,10856],{},[155,10849,10850],{},"CrowdStrike",": Pushed a faulty kernel driver that caused immediate kernel panics.",[2872,10853],{},[155,10855,3329],{},": eBPF programs are verified before loading. A \"bad\" program simply fails to load; it cannot cause a kernel panic.",[73,10858,10860],{"id":10859},"failure-mode-2-memory-corruption","Failure Mode 2: Memory Corruption",[12,10862,10863,10865,10866,10868,10870],{},[155,10864,10850],{},": Kernel drivers can corrupt kernel memory, leading to system instability.",[2872,10867],{},[155,10869,3329],{},": eBPF programs run in a sandboxed environment with verified memory access. They cannot access arbitrary kernel memory.",[73,10872,10874],{"id":10873},"failure-mode-3-infinite-loopshangs","Failure Mode 3: Infinite Loops\u002FHangs",[12,10876,10877,10879,10880,10882,10884],{},[155,10878,10850],{},": A kernel driver in an infinite loop hangs the entire system.",[2872,10881],{},[155,10883,3329],{},": The eBPF verifier explicitly prohibits unbounded loops. Every eBPF program is guaranteed to complete.",[73,10886,10888],{"id":10887},"failure-mode-4-cascading-failures","Failure Mode 4: Cascading Failures",[12,10890,10891,10893,10894,10896,10898],{},[155,10892,10850],{},": One bad driver affects all processes system-wide.",[2872,10895],{},[155,10897,3329],{},": eBPF programs are attached to specific probe points. Even in failure, they only affect the specific operation they're monitoring.",[29,10900,10902],{"id":10901},"real-world-safety-mechanisms","Real-World Safety Mechanisms",[12,10904,10905],{},"Let's get concrete about what happens in various failure scenarios:",[73,10907,10909],{"id":10908},"scenario-1-ebpf-program-has-a-bug","Scenario 1: eBPF Program Has a Bug",[1546,10911,10914],{"className":10912,"code":10913,"language":1551},[1549],"What happens: The kernel verifier rejects it at load time\nSystem impact: Zero (program never runs)\nQtap behavior: Falls back to connection metadata only (no payload visibility)\n",[284,10915,10913],{"__ignoreMap":184},[73,10917,10919],{"id":10918},"scenario-2-userspace-agent-crashes","Scenario 2: Userspace Agent Crashes",[1546,10921,10924],{"className":10922,"code":10923,"language":1551},[1549],"What happens: Standard application crash\nSystem impact: None (kernel continues normally)\nQtap behavior: Kubernetes\u002Fsystemd restarts the agent\nData loss: Minimal (only in-flight data in buffers)\n",[284,10925,10923],{"__ignoreMap":184},[73,10927,10929],{"id":10928},"scenario-3-memory-pressure","Scenario 3: Memory Pressure",[1546,10931,10934],{"className":10932,"code":10933,"language":1551},[1549],"What happens: Container hits memory limit\nSystem impact: Container is OOM-killed\nQtap behavior: Restarts, eBPF programs continue collecting\nYour apps: Continue running normally\n",[284,10935,10933],{"__ignoreMap":184},[73,10937,10939],{"id":10938},"scenario-4-qtap-consumes-too-much-cpu","Scenario 4: Qtap Consumes Too Much CPU",[1546,10941,10944],{"className":10942,"code":10943,"language":1551},[1549],"What happens: Container CPU is throttled\nSystem impact: Qtap slows down, not your applications\nQtap behavior: May drop some events under extreme load\nYour apps: Unaffected due to container isolation\n",[284,10945,10943],{"__ignoreMap":184},[29,10947,10949],{"id":10948},"performance-impact-the-numbers","Performance Impact: The Numbers",[12,10951,10952],{},"Since we're being transparent, here's what our testing shows:",[237,10954,10955,10961,10967,10973],{},[240,10956,10957,10960],{},[155,10958,10959],{},"Latency impact",": \u003C 10 microseconds per TLS operation (statistically insignificant)",[240,10962,10963,10966],{},[155,10964,10965],{},"CPU overhead",": ~2-5% for typical workloads",[240,10968,10969,10972],{},[155,10970,10971],{},"Memory usage",": 50-350MB for the agent, negligible for eBPF programs",[240,10974,10975,10978],{},[155,10976,10977],{},"Network overhead",": Zero (we don't proxy your traffic)",[12,10980,10981],{},"Compare this to traditional MITM proxies that add milliseconds of latency, require managing certificates, and introduce a single point of failure.",[29,10983,10985],{"id":10984},"trust-but-verify","Trust, But Verify",[12,10987,10988],{},"We encourage you to validate our safety claims:",[267,10990,10991,11000,11006,11012],{},[240,10992,10993,1590,10996,10999],{},[155,10994,10995],{},"Review our eBPF source",[731,10997,3329],{"href":5496,"rel":10998},[735]," is open for inspection. It's small enough to audit in an afternoon.",[240,11001,11002,11005],{},[155,11003,11004],{},"Test in staging",": Deploy Qtap in your staging environment. Try to break it. Kill the agent, exhaust memory, simulate failures. You'll see it fails safely. Tell us what you find!",[240,11007,11008,11011],{},[155,11009,11010],{},"Monitor standard metrics",": CPU, memory, and network usage are all observable through standard Kubernetes\u002FLinux tooling.",[240,11013,11014,11017],{},[155,11015,11016],{},"Check the verifier logs",": When Qtap loads eBPF programs, the kernel verifier logs show exactly what checks were performed.",[29,11019,3334],{"id":3333},[12,11021,11022],{},"Running Qtap requires elevated privileges and deploys code into kernel space; these are facts. But through eBPF's safety guarantees, clear separation between kernel and userspace components, and standard resource controls, we've built an architecture that fails safely and predictably.",[12,11024,11025],{},"Your security team is right to be cautious about kernel-level agents. We built Qtap specifically to address those concerns while still providing the deep visibility modern operations require. The eBPF verifier is your safety net, container isolation is your blast radius control, and our simple architecture means fewer things that can go wrong.",[12,11027,11028],{},[250,11029,11030],{},"Want to dig deeper? Our engineering team is happy to walk through the eBPF verifier output for our programs, show you our failure testing results, or help you set up monitoring for Qtap in your environment. Because when it comes to production safety, transparency builds trust.",[16,11032],{},[12,11034,11035],{},[155,11036,11037],{},"Next Steps:",[237,11039,11040,11049,11057],{},[240,11041,11042,11043,11048],{},"Read our ",[731,11044,11047],{"href":11045,"rel":11046},"https:\u002F\u002Fdocs.qpoint.io",[735],"technical documentation"," for detailed deployment guides",[240,11050,11051,11052],{},"Try Qtap in a sandbox environment at ",[731,11053,11056],{"href":11054,"rel":11055},"https:\u002F\u002Fapp.qpoint.io",[735],"app.qpoint.io",[240,11058,11059],{},"Join our community Slack to talk directly with our engineers",{"title":184,"searchDepth":185,"depth":185,"links":11061},[11062,11066,11070,11076,11082,11083,11084],{"id":10674,"depth":185,"text":10675,"children":11063},[11064,11065],{"id":10698,"depth":191,"text":10699},{"id":10746,"depth":191,"text":10747},{"id":10782,"depth":185,"text":10783,"children":11067},[11068,11069],{"id":10794,"depth":191,"text":10795},{"id":10804,"depth":191,"text":10805},{"id":10831,"depth":185,"text":10832,"children":11071},[11072,11073,11074,11075],{"id":10844,"depth":191,"text":10845},{"id":10859,"depth":191,"text":10860},{"id":10873,"depth":191,"text":10874},{"id":10887,"depth":191,"text":10888},{"id":10901,"depth":185,"text":10902,"children":11077},[11078,11079,11080,11081],{"id":10908,"depth":191,"text":10909},{"id":10918,"depth":191,"text":10919},{"id":10928,"depth":191,"text":10929},{"id":10938,"depth":191,"text":10939},{"id":10948,"depth":185,"text":10949},{"id":10984,"depth":185,"text":10985},{"id":3333,"depth":185,"text":3334},"2025-09-05","Let's address the elephant in the room. After recent high-profile kernel agent failures that took down millions of systems worldwide, your security and operations teams are rightfully cautious about anything that touches the kernel. When we tell you that Qtap needs elevated privileges and deploys eBPF programs into kernel space, we understand the skepticism.","\u002Fimages\u002F2025.Q3\u002Ffire-bottle.png","\u002Fimages\u002F2025.Q3\u002Fhidden-complexities.jpg",{},"\u002Fblog\u002Fwhy-running-qtap-in-production-is-safe",{"title":10660,"description":11086},"why-running-qtap-in-production-is-safe","blog\u002Fwhy-running-qtap-in-production-is-safe","peq4pcwbsbjrU21w-9QpbMxz8g87tuMHbbnBl3osrjc",{"id":11096,"title":11097,"author":5565,"body":11098,"date":11215,"description":11216,"excerpt":197,"extension":198,"eyebrow":197,"heroImage":11217,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":197,"logoColor":197,"maxImgWidth":197,"meta":11218,"navigation":201,"path":9593,"seo":11219,"slug":11220,"stem":11221,"subHeadline":11216,"tags":197,"__hash__":11222},"blog\u002Fblog\u002Fwhy-securing-egress-traffic-matters.md","Why Securing Egress Traffic Matters",{"type":9,"value":11099,"toc":11208},[11100,11109,11113,11116,11120,11123,11127,11130,11135,11139,11142,11147,11150,11154,11157,11184,11186,11190,11193,11196],[12,11101,11102,11103,11108],{},"Thousands of data breaches occur in the U.S. every year, costing companies close to a whopping ",[731,11104,11107],{"href":11105,"rel":11106},"https:\u002F\u002Fwww.statista.com\u002Fstatistics\u002F273575\u002Fus-average-cost-incurred-by-a-data-breach\u002F#:~:text=As%20of%202023%2C%20the%20average,dollars%20in%20the%20previous%20year.",[735],"$10 million"," per breach. While countless tools and vendors aim to reduce the number and impact of these breaches, the reality remains that they continue to grow. This is due in part to the fact that many solutions are focused on what (or who) is entering the network, but remain blind to what is exiting it. Modern production applications are increasingly reliant on a web of external vendors and APIs, resulting in egress traffic that exposes the organization to as much risk as ingress traffic does.",[73,11110,11112],{"id":11111},"egress-vs-ingress","Egress vs. Ingress",[12,11114,11115],{},"Egress traffic refers to the data that flows out from a particular network or device to another network, such as the internet or a different local network. It can include various types of data, such as web requests, emails, file downloads and more. Ingress traffic is the opposite of egress traffic. It refers to the data that flows into a particular network or device from another network. Understanding and managing both types of traffic is essential to ensure efficient network operation and security, but many companies have a blind spot when it comes to egress. Over the years, this has contributed to massive data breaches that could have been mitigated with better visibility into, and control over, egress.",[73,11117,11119],{"id":11118},"mitigating-data-breaches-with-observability-and-zero-trust","Mitigating Data Breaches with Observability and Zero Trust",[12,11121,11122],{},"Regardless of an attacker’s strategy, a cyber attack must exfiltrate sensitive data to be successful. For the vast majority of attacks, a tool that can restrict outbound access based on identity or scan for sensitive data on egress can prevent or significantly reduce the impact of a data breach. There have been numerous breaches over the last decade that could have been mitigated with a zero trust strategy for egress, including the following that resulted in long-lasting reputational damage.",[1179,11124,11126],{"id":11125},"solarwinds-orion","SolarWinds Orion",[12,11128,11129],{},"This 2020 attack involved the insertion of malicious code into SolarWinds' Orion IT management software, which was distributed to thousands of SolarWinds customers through software updates. While the breach was not solely due to poor egress security, implementing egress best practices could have mitigated its impact and prevented aspects of the attack. For example, if the affected networks had a tool controlling which external APIs SolarWinds could access, it might have prevented the malware from communicating with the attacker's servers.",[12,11131,11132],{},[179,11133],{"alt":184,"src":11134},"\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.05.30.why.securing\u002F29ee0695-345e-40bb-b716-36ac4a45c681.png",[1179,11136,11138],{"id":11137},"home-depot","Home Depot",[12,11140,11141],{},"In 2014, customer credit card information was exfiltrated from Home Depot point-of-sale (POS) systems to external servers controlled by attackers. If Home Depot’s team had better visibility into the egress traffic from individual store locations, they may have been able to identify the compromised POS systems and the extent of the breach faster. A zero trust strategy designed to limit external access from Home Depot's store location networks and enforced by an egress controller could have prevented access to the attacker's external systems altogether.",[12,11143,11144],{},[179,11145],{"alt":184,"src":11146},"\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.05.30.why.securing\u002F467ed101-155e-4cad-a940-0bef9d882a4f.png",[12,11148,11149],{},"Implementing a zero trust strategy for egress has become even more critical in recent years as attackers have gotten more sophisticated and attack vectors have significantly increased. Organizations can reduce or eliminate the impact of cyber attacks by deploying tools that increase visibility, restrict outbound access, and scan for sensitive data on egress - as evidenced by the above high-profile breaches and many more like them.",[73,11151,11153],{"id":11152},"egress-security-best-practices","Egress Security Best Practices",[12,11155,11156],{},"The following best practices set the foundation for egress security for a platform engineering team. By implementing these practices, organizations can greatly reduce the risk of an egress-related data breach.",[237,11158,11159,11162,11165,11170,11176,11181],{},[240,11160,11161],{},"**Discovery & Monitoring: **By tapping into their egress traffic flow, platform teams can discover which applications are making external requests and what the endpoints are. This is vital for understanding the full scope of external dependencies and interactions, and detection of anomalies in traffic patterns.",[240,11163,11164],{},"**Alerting: **Alerts can notify the team of a potential issue or anomalous behavior before it escalates into a major problem. This proactive detection can minimize downtime and maintain the stability of the platform.",[240,11166,11167,11169],{},[155,11168,10560],{}," Maintaining detailed audit logs of egress traffic is crucial for tracking all outbound requests and responses. This ensures traceability and accountability, facilitating thorough investigations in case of security incidents.",[240,11171,11172,11175],{},[155,11173,11174],{},"Access Control:"," A zero trust approach with default deny and identity-based access control policies ensures that only authorized applications have the necessary permissions to access external resources. This reduces the likelihood of sensitive data exfiltration by restricting external access to only those applications that require it.",[240,11177,11178,11180],{},[155,11179,8124],{}," Getting a handle on API token sprawl reduces the risk of unauthorized access, data breaches and data exfiltration by hackers using stolen credentials. By implementing robust management, monitoring and governance practices, organizations can ensure the secure use of API tokens across environments.",[240,11182,11183],{},"**PII Mapping & Scrubbing: **A platform team needs to know which applications are sending PII outside the network and where it’s going, in order to prevent unauthorized exfiltration of sensitive data. The ability to obscure or scrub sensitive data in-line before a request leaves the network provides extra insurance.",[73,11185],{"id":184},[73,11187,11189],{"id":11188},"tap-in-and-take-control-of-egress-with-qpoint","Tap In and Take Control of Egress with Qpoint",[12,11191,11192],{},"Visibility into and control over egress traffic is an indispensable part of a platform team’s security strategy as core production applications become more interconnected and as attackers grow more sophisticated. Implementing the above best practices with home grown tooling, however, can be a challenging task and a significant distraction for busy engineers.",[12,11194,11195],{},"Qpoint offers an easy to deploy and flexible solution to enable platform teams to enhance egress observability, apply zero trust security principles, and increase operational resilience for the platform as a whole and the core production applications that run on their networks.",[12,11197,11198,11199,11203,11204,11207],{},"Are you ready to safeguard egress for your production application environments? Explore how Qpoint can help you tap into and take control of your egress traffic in our ",[731,11200,11202],{"href":1305,"rel":11201},[735],"docs"," or with a ",[731,11205,11206],{"href":1311},"demo"," by our solutions engineering team.",{"title":184,"searchDepth":185,"depth":185,"links":11209},[11210,11211,11212,11213,11214],{"id":11111,"depth":191,"text":11112},{"id":11118,"depth":191,"text":11119},{"id":11152,"depth":191,"text":11153},{"id":184,"depth":191,"text":184},{"id":11188,"depth":191,"text":11189},"2024-05-30","Learn egress security best practices for production environments and the importance of securing egress traffic for preventing and mitigating data breaches.","\u002Fimages\u002Fblog\u002F2025.Q3\u002F2024.05.30.why.securing\u002Fblog-1-main@3x.png",{},{"title":11097,"description":11216},"why-securing-egress-traffic-matters","blog\u002Fwhy-securing-egress-traffic-matters","Q3fP70wbPlvQSYdty7lbxifGAqPmJHzqNhTj7asfWc0",{"id":11224,"title":11225,"author":11226,"body":11227,"date":11564,"description":11565,"excerpt":197,"extension":198,"eyebrow":11566,"heroImage":11567,"heroImageClasses":197,"heroShadow":201,"isFeatured":202,"isListed":201,"isSecondaryFeatured":202,"listingImage":11568,"logoColor":197,"maxImgWidth":197,"meta":11569,"navigation":201,"path":11570,"seo":11571,"slug":11572,"stem":11573,"subHeadline":11565,"tags":197,"__hash__":11574},"blog\u002Fblog\u002Fyour-agents-need-a-dynamic-sandbox.md","Your Agents Need a Dynamic Sandbox","The Qpoint Team",{"type":9,"value":11228,"toc":11554},[11229,11232,11239,11246,11252,11256,11259,11265,11271,11277,11283,11286,11290,11293,11296,11307,11310,11313,11319,11322,11328,11331,11335,11338,11341,11361,11364,11367,11373,11390,11393,11432,11435,11439,11442,11451,11454,11460,11467,11471,11474,11477,11480,11483,11486,11490,11498,11507,11516,11519,11523,11526,11529,11532,11535,11548],[12,11230,11231],{},"Most sandboxes for AI agents today are static. Your security team writes the rules and policies upfront before an agent runs: which commands an agent can run, which paths can be read, which domains can be reached. This static set of rules sets the guardrails that contain what an agent can do.",[12,11233,11234,11235,11238],{},"This strategy works for traditional software that performs the same set of operations every time. AI agents do not work this way. Ask an agent to fix a failing deploy and it might run Terraform, open ",[284,11236,11237],{},"~\u002F.aws\u002Fconfig",", install a package, write a helper script, and call three APIs it has never touched before. None of which was planned. The agent decided what actions to take as it went along.",[12,11240,11241,11242,11245],{},"Static rules can’t possibly account for a set of actions that are determined by the agent at runtime. A static sandbox is an access list. It can say which files, commands, and hosts are allowed. It can’t account for unforeseen actions and, critically, it can’t judge ",[250,11243,11244],{},"intent",": why the agent is doing something, and whether the actions taken should be allowed. A dynamic sandbox sees each action in real time, and makes a decision inline, based on the policies set by your security team. That’s what we are building at Qpoint.",[12,11247,11248],{},[179,11249],{"alt":11250,"src":11251},"Static sandbox with access rules decided before the run, compared to a dynamic sandbox that judges the intent behind each action against your policies","\u002Fimages\u002F2026.Q4\u002Fblog\u002Fdynamic-sandbox\u002Fstatic-vs-dynamic.svg",[29,11253,11255],{"id":11254},"what-a-static-sandbox-looks-like-today","What a static sandbox looks like today",[12,11257,11258],{},"There are a few common approaches, and most teams use a combination of them.",[12,11260,11261,11264],{},[155,11262,11263],{},"Harness permission settings."," Claude Code has allow and deny lists for tools and commands. Codex has sandbox modes. Every harness does it a little differently, and the rules only apply inside that harness.",[12,11266,11267,11270],{},[155,11268,11269],{},"Harness plugins and hooks."," You write code that blocks certain calls in one harness. Then your developers start using Codex, or Cursor, or whatever ships next month, and you start over.",[12,11272,11273,11276],{},[155,11274,11275],{},"Containers and VMs."," The agent runs in a box with a mounted workspace and a fixed egress allowlist.",[12,11278,11279,11282],{},[155,11280,11281],{},"Network controls."," An AI gateway or firewall rule can see the destination for every request, but not which agent sent it or why.",[12,11284,11285],{},"Every one of these approaches is an access list in some form: allow lists, deny lists, egress lists. The decisions get made before an agent runs, based on an assumption about what it’s going to do, and none of them can see an agent’s intent. These assumptions are often wrong in one of two directions. If the rules are too tight, the agent stalls every time it needs a new package registry or API. Developers get permission prompts all day, and eventually someone turns on the skip-permissions flag. If the rules are too loose, the allowlist keeps growing until it isn’t really a boundary anymore. At that point you have a log, not a sandbox.",[29,11287,11289],{"id":11288},"agents-route-around-static-rules","Agents route around static rules",[12,11291,11292],{},"Here’s a scenario that almost every agent security approach runs into.",[12,11294,11295],{},"Say you write a plugin for Claude Code that’s supposed to stop the agent from using the GitHub API. The agent makes an HTTPS call to api.github.com, and the plugin says no. Great, problem solved.",[12,11297,11298,11299,11302,11303,11306],{},"Except these models are smart. They’ll go back and try curl, or wget. If those are blocked too, the agent will write a Python script that uses ",[284,11300,11301],{},"requests"," in one turn and run it with ",[284,11304,11305],{},"python3"," in the next.",[12,11308,11309],{},"The harness plugin never sees that request, because it didn’t come from a tool call. It came from a Python process. The network just sees a client on the laptop talking to GitHub. Nothing exists that connects the request to the agent that it originated from.",[12,11311,11312],{},"Static rules only cover the paths your security team anticipated. The agent has as many paths as it can come up with, and it’s very good at coming up with them.",[12,11314,11315],{},[179,11316],{"alt":11317,"src":11318},"In a static sandbox, a tool call and curl are blocked by harness plugin rules, but a Python script the agent writes gets through because the network sees a non-agent client","\u002Fimages\u002F2026.Q4\u002Fblog\u002Fdynamic-sandbox\u002Frouting-static.svg",[12,11320,11321],{},"We handle this by treating the agent and every process it starts as one surface. When Qpoint taps into an agent session, whether that’s Claude Code or a bash session, anything that happens in it or in one of its child processes is attributed to that agent. So when the agent runs Python, Qpoint sees that. When the Python script opens a connection to GitHub, Qpoint sees that too, and attributes the connection to the agent. A plugin can block it in real time. Or it can tag the traffic with the agent’s ID and profile so the network can make the call. The network becomes agent aware.",[12,11323,11324],{},[179,11325],{"alt":11326,"src":11327},"With Qpoint, the agent and its child processes are seen as one surface, so all three attempts, including the Python script, are blocked or tagged and the network becomes agent aware","\u002Fimages\u002F2026.Q4\u002Fblog\u002Fdynamic-sandbox\u002Frouting-qpoint.svg",[12,11329,11330],{},"The audit log records all of this under the agent session. An HTTP request shows up as an HTTP request from that agent session, whether the agent made it directly or through a script three processes down. We’ll go deeper on this hidden surface in an upcoming post.",[29,11332,11334],{"id":11333},"what-a-dynamic-sandbox-does","What a dynamic sandbox does",[12,11336,11337],{},"A dynamic sandbox sits in between the agent and the operating system. When Qpoint starts, it surgically inserts a runtime layer between each agent and the underlying OS, based on the rules you set. You don’t modify or run the agent inside anything, change how it starts, or configure anything per agent. The harness runs exactly the way it did before, and is completely unaware that Qpoint has become the I\u002FO surface broker.",[12,11339,11340],{},"An agent only has three ways to act:",[237,11342,11343,11349,11355],{},[240,11344,11345,11348],{},[155,11346,11347],{},"File I\u002FO:"," reading and writing files.",[240,11350,11351,11354],{},[155,11352,11353],{},"Exec I\u002FO:"," running commands, scripts, and other programs.",[240,11356,11357,11360],{},[155,11358,11359],{},"Network I\u002FO:"," calling APIs, model providers, and anything else on the network.",[12,11362,11363],{},"MCP servers sit on those same paths. A local MCP server runs as a command, and a remote one is a network connection. Either way, an MCP server can run anything, which effectively gives it full access.",[12,11365,11366],{},"Those three paths are the surface Qpoint takes over. When the agent reads a file, the request goes through the Qpoint runtime first. The same is true for every command it runs and every connection it opens, including the ones made by scripts created by the agent.",[12,11368,11369],{},[179,11370],{"alt":11371,"src":11372},"The agent and every process it starts reach the operating system through file, exec, and network I\u002FO, all of which pass through the Qpoint runtime, where plugins apply your policies","\u002Fimages\u002F2026.Q4\u002Fblog\u002Fdynamic-sandbox\u002Fqpoint-runtime.svg",[12,11374,11375,11376,1940,11380,11384,11385,11389],{},"The runtime turns each action into a simple event, like a file read, a command, or a request, with the path or host, the process, the agent, and the session attached. The events look the same on macOS, Windows, and Linux, so the same plugins work everywhere. This single runtime is what lets Qpoint ",[731,11377,11379],{"href":11378},"\u002Fproduct\u002Fmonitor","monitor",[731,11381,11383],{"href":11382},"\u002Fproduct\u002Fgovern","govern",", and ",[731,11386,11388],{"href":11387},"\u002Fproduct\u002Fsecure","secure"," agents.",[12,11391,11392],{},"For monitoring, events are sent asynchronously, so the agent never waits on them. For enforcement, a plugin decides what happens before a given action completes. Plugins have many enforcement options:",[237,11394,11395,11400,11410,11416,11426],{},[240,11396,11397],{},[155,11398,11399],{},"Allow it.",[240,11401,11402,11405,11406,11409],{},[155,11403,11404],{},"Deny it."," If the agent tries to read ",[284,11407,11408],{},"~\u002F.ssh\u002Fid_ed25519",", it gets a normal file-not-found error and moves on, or asks the user for what it needed.",[240,11411,11412,11415],{},[155,11413,11414],{},"Redirect it."," Instead of this file, open that one.",[240,11417,11418,11421,11422,11425],{},[155,11419,11420],{},"Change the content."," Let the agent read the ",[284,11423,11424],{},".env"," file, but replace every value with a placeholder. It still sees the shape of the config and can do its job.",[240,11427,11428,11431],{},[155,11429,11430],{},"Rewrite outbound requests."," For example, strip an API key out of a prompt before it goes to api.anthropic.com.",[12,11433,11434],{},"The agent is unaware that any of this is happening, and continues to run as it normally would.",[29,11436,11438],{"id":11437},"judging-intent-not-just-access","Judging intent, not just access",[12,11440,11441],{},"Now take a fleet of agents. Say a thousand Claude Code instances running on Linux servers or developer laptops.",[12,11443,11444,11445,11448,11449,221],{},"Every action is first checked against the existing ruleset, and most of what the agents do is already covered. But some actions can’t be decided by an access rule. Take a read of ",[284,11446,11447],{},"~\u002F.aws\u002Fcredentials",". If the agent is fixing a deploy and needs the profile name, that read might be fine. If it just read a README with hidden instructions and its next step is a connection to an unknown IP, it isn’t. The file read is identical, so an access list has to treat both the same. The difference is the agent’s ",[250,11450,11244],{},[12,11452,11453],{},"Dynamically enforced policies can be written in plain language, like “agents can read from internal APIs but can’t send credentials or customer data to third parties.” When an action needs a judgment call, the plugin asks an AI judge to check it against that policy, taking into account the agent’s assigned task and the actions it has already taken in the session. The AI judge is consulted only for actions that are not covered by the existing ruleset. If the judge’s decision doesn’t depend on session context, it’s saved as a new rule. The next time any agent in the fleet takes the same action, it’s handled by a rule check with no model call.",[12,11455,11456],{},[179,11457],{"alt":11458,"src":11459},"When an agent takes an action, such as accessing a new MCP server, an existing rule is applied with no model call. If no rule exists, the AI judge checks intent against policy and the result is saved as a new rule across the fleet","\u002Fimages\u002F2026.Q4\u002Fblog\u002Fdynamic-sandbox\u002Fai-judge.svg",[12,11461,11462,11463,11466],{},"The result is a ruleset that grows with your agents. Your security team writes ",[731,11464,11465],{"href":11382},"policies"," in plain language, and the sandbox applies them to every new action. Agents that decide their own actions at runtime can’t be secured with a hand-written access list. It takes an AI judge in the decision path, evaluating the agent’s intent.",[29,11468,11470],{"id":11469},"how-qpoint-can-do-this","How Qpoint can do this",[12,11472,11473],{},"Before AI agents went mainstream, we spent two years using eBPF to map sensitive data flows at the source in Linux production environments.",[12,11475,11476],{},"Then agents took off, and we started getting the same question from every direction: can you see what an agent is doing on the endpoint? Endpoints mostly run macOS and Windows, not Linux, so eBPF was out. Operations and security teams wanted visibility into and control over the AI agents running in their environments.",[12,11478,11479],{},"So we ran an experiment to see if we could get the same visibility and control without eBPF. Long story short, it worked.",[12,11481,11482],{},"What we built is a layered approach that uses several techniques which vary by operating system. It combines native OS and kernel capabilities with our own technology, which reads an application’s binary and isolates the code paths it uses for file, exec, and network I\u002FO. The result is the same on every platform: one runtime, the same events, and the same plugins.",[12,11484,11485],{},"We also built it so plugins run outside the agent’s process. If a plugin fails, the agent is isolated from the failure.",[29,11487,11489],{"id":11488},"where-qpoint-runs","Where Qpoint runs",[12,11491,11492,11497],{},[155,11493,11494,3016],{},[731,11495,6875],{"href":11496},"\u002Fsolutions\u002Fendpoints"," developer laptops on macOS, Windows, and Linux, deployed through your existing MDM, such as Jamf or Intune.",[12,11499,11500,11506],{},[155,11501,11502,3016],{},[731,11503,11505],{"href":11504},"\u002Fsolutions\u002Fhosted-agents","Hosted agents"," containers, VMs, Kubernetes, and CI runners. On Kubernetes, agents are deployed with labels, and the Qpoint spec defines which agents to watch and how to tap into them.",[12,11508,11509,11515],{},[155,11510,11511,3016],{},[731,11512,11514],{"href":11513},"\u002Fsolutions\u002Fembedded","Embedded"," shipped as a shared library inside another vendor’s agent or sensor. This is how a large security vendor is integrating Qpoint today.",[12,11517,11518],{},"All three use the same plugins and the same set of events.",[29,11520,11522],{"id":11521},"security-that-keeps-up-with-your-agents","Security that keeps up with your agents",[12,11524,11525],{},"AI agents don’t follow a script. They interpret their context, decide on their next action at runtime, and try a different approach when one is blocked. A sandbox built on static rules will always be one step behind.",[12,11527,11528],{},"A dynamic sandbox works at the same speed as the agent. It sees every file, command, and network request, including the ones that come from a script the agent wrote a turn earlier. It allows, denies, redirects, or rewrites each action before it completes, and it works the same for every harness. And when you need more than an access list, it can judge intent too.",[29,11530,11531],{"id":5501},"What’s next",[12,11533,11534],{},"This is the first post in a series on securing AI agents. Next, we’ll examine the hidden surface: the actions agents take through the scripts and processes they spawn, and why most security tools never see them. After that, we’ll make the case for treating agents as insiders, subject to the same controls you’d apply to any person with access to your systems.",[12,11536,11537,11538,11541,11542,11384,11545,221],{},"Qpoint can monitor, govern, and secure agents on ",[731,11539,11540],{"href":11496},"employee laptops",", in your ",[731,11543,11544],{"href":11504},"hosted infrastructure",[731,11546,11547],{"href":11513},"inside the products you build",[12,11549,11550,11553],{},[731,11551,10639],{"href":11552},"\u002Fdemo"," to see a dynamic sandbox in action in your environment.",{"title":184,"searchDepth":185,"depth":185,"links":11555},[11556,11557,11558,11559,11560,11561,11562,11563],{"id":11254,"depth":185,"text":11255},{"id":11288,"depth":185,"text":11289},{"id":11333,"depth":185,"text":11334},{"id":11437,"depth":185,"text":11438},{"id":11469,"depth":185,"text":11470},{"id":11488,"depth":185,"text":11489},{"id":11521,"depth":185,"text":11522},{"id":5501,"depth":185,"text":11531},"2026-10-15","Block an AI agent from the GitHub API, and it will try curl. Block curl, and it will write a Python script and run that instead. That’s the problem with most agent sandboxes today: they’re static. Your security team writes the rules upfront before an agent runs, and the agent spends the session finding paths around the static guardrails that have been set.","Static vs. Dynamic Sandbox","\u002Fimages\u002F2026.Q4\u002Fblog\u002Fdynamic-sandbox\u002Fhero.svg","\u002Fimages\u002F2026.Q4\u002Fblog\u002Fdynamic-sandbox\u002Flisting.png",{},"\u002Fblog\u002Fyour-agents-need-a-dynamic-sandbox",{"title":11225,"description":11565},"your-agents-need-a-dynamic-sandbox","blog\u002Fyour-agents-need-a-dynamic-sandbox","sZXqCsgZT72_11ourCzXNf0OmXKRnOcEP8eEHapigzY",[11576,11590,11603,11616,11629,11643,11655],{"id":11577,"title":11578,"bio":11579,"extension":198,"meta":11580,"name":11585,"photo":11586,"slug":11587,"stem":11588,"__hash__":11589},"people\u002Fpeople\u002Fandrew-valencia.md","Team Member","Team member at QPoint.",{"body":11581},{"type":9,"value":11582,"toc":11583},[],{"title":184,"searchDepth":185,"depth":185,"links":11584},[],"Andrew Valencia","\u002Fimages\u002Fteam\u002Fandrew-valencia.png","andrew-valencia","people\u002Fandrew-valencia","O34fLL5DAhRy3bHGxEsgYCCpBKzi6ViosB0FBcRoWBc",{"id":11591,"title":11592,"bio":11593,"extension":198,"meta":11594,"name":11599,"photo":11600,"slug":7,"stem":11601,"__hash__":11602},"people\u002Fpeople\u002Fdevin-bernosky.md","Co-founder & CTO","Co-founder and CTO of QPoint, leading technical strategy and product development.",{"body":11595},{"type":9,"value":11596,"toc":11597},[],{"title":184,"searchDepth":185,"depth":185,"links":11598},[],"Devin Bernosky","\u002Fimages\u002Fteam\u002Fdevin.jpg","people\u002Fdevin-bernosky","lfUhAhQyCCRXIdpGHFiXIpYLNrDZoJy2NdSmovIzpgw",{"id":11604,"title":11605,"bio":11606,"extension":198,"meta":11607,"name":11612,"photo":11613,"slug":599,"stem":11614,"__hash__":11615},"people\u002Fpeople\u002Fjon-friesen.md","Senior Engineer","Senior Engineer at QPoint, focused on platform reliability and middleware solutions.",{"body":11608},{"type":9,"value":11609,"toc":11610},[],{"title":184,"searchDepth":185,"depth":185,"links":11611},[],"Jon Friesen","\u002Fimages\u002Fteam\u002Fjon-friesen.jpg","people\u002Fjon-friesen","a4sqtJdMX3qdF82ASWxCtItI8dEnLcasvdwDbxY9oFA",{"id":11617,"title":11618,"bio":11619,"extension":198,"meta":11620,"name":11625,"photo":11626,"slug":1151,"stem":11627,"__hash__":11628},"people\u002Fpeople\u002Fmarc-barry.md","Technical Writer","Technical writer at QPoint, specializing in external integrations and API security.",{"body":11621},{"type":9,"value":11622,"toc":11623},[],{"title":184,"searchDepth":185,"depth":185,"links":11624},[],"Marc Barry","\u002Fimages\u002Fteam\u002Fmarc-barry.png","people\u002Fmarc-barry","RderWlTeidGutqfzJ6ipLExSl0Rs-XojvxZgkyAz2kQ",{"id":11630,"title":11631,"bio":11632,"extension":198,"meta":11633,"name":11638,"photo":11639,"slug":11640,"stem":11641,"__hash__":11642},"people\u002Fpeople\u002Fmark-parson.md","Co-founder","Co-founder of QPoint, focused on business strategy and customer success.",{"body":11634},{"type":9,"value":11635,"toc":11636},[],{"title":184,"searchDepth":185,"depth":185,"links":11637},[],"Mark Parson","\u002Fimages\u002Fteam\u002Fmark-parson.jpeg","mark-parson","people\u002Fmark-parson","nP5IMGKC13EPHk-lwnLt1On-0V2yg4284YfrQoSF9Ws",{"id":11644,"title":11618,"bio":11645,"extension":198,"meta":11646,"name":11651,"photo":11652,"slug":5565,"stem":11653,"__hash__":11654},"people\u002Fpeople\u002Frob-genova.md","Technical writer at QPoint, specializing in security and compliance content.",{"body":11647},{"type":9,"value":11648,"toc":11649},[],{"title":184,"searchDepth":185,"depth":185,"links":11650},[],"Rob Genova","\u002Fimages\u002Fteam\u002Frob-genova.png","people\u002Frob-genova","UB0wWpdFWzaR9TSti8YwV8664yRLzLcVFQfvmACQQyY",{"id":11656,"title":11657,"bio":11658,"extension":198,"meta":11659,"name":5516,"photo":11664,"slug":5202,"stem":11665,"__hash__":11666},"people\u002Fpeople\u002Ftyler-flint.md","Co-founder & CEO","Co-founder and CEO of QPoint, focused on making service dependencies visible, controllable, and secure.",{"body":11660},{"type":9,"value":11661,"toc":11662},[],{"title":184,"searchDepth":185,"depth":185,"links":11663},[],"\u002Fimages\u002Fteam\u002Ftyler.jpg","people\u002Ftyler-flint","XJtwBcO8b_xBN74hLkwMh4ADiNHVY8A_gZUfkp3EL3k",1792178398231]