Code-Reduction | Attack Surface Reduction Manifesto

Linux kernel

A June 2026 kernel commit called the userspace crypto interface "a frequent source of vulnerabilities" and narrowed it to an allowlist.

Anthropic / OpenSSH

Three passes over 25 projects reported 493 issues; the OpenSSH fix moved an allowlist check ahead of the parse and off the pre-auth path.

Datadog

The Agent's artifacts nearly tripled in size, so the team audited imports and let the compiler drop 570 packages from one binary.

Basecamp

A small team runs a product used by millions by refusing features rather than scheduling them, and by keeping what it operates small enough to hold.

tiny

1,854 lines of controller code, six controllers and one pod went away, taking a service account that could read every secret in the namespace.

Code Reduction