Fixed/disclosed vulnerabilities, auth bugs, hardening, CVE write-ups.
Our WAF rate limit and managed rules worked perfectly, for anyone polite enough to go through CloudFront. A scripted client hitting the ALB hostname directly skipped all of it. Here is how we found it, why it happens, and the layered origin protection we now ship by default.
A practical guide to cookie attributes for engineers who keep getting logged out of embedded widgets or failing security reviews: what SameSite, Secure, HttpOnly, __Host- and Partitioned really do, with tested defaults for common setups.
A pull request added a dependency that an AI assistant had suggested. The package name did not exist when the code was written, and a few weeks later someone else published it. We caught it in review by luck, then added registry checks so we do not rely on luck.
Our comment system rendered Markdown and stripped script tags, yet a link with a javascript: URL survived into the page. We fixed it by sanitizing the rendered HTML with an allowlist of tags, attributes and URL schemes, and backed it with a strict Content-Security-Policy.
An internal audit found a workflow that used pull_request_target to post preview links and also checked out the pull request's code and ran npm install. Any fork PR could have run code with our deploy token. We split it into an unprivileged build and a privileged comment step.
Our first Terraform apply in ap-southeast-3 failed with an explicit deny even though the role had AdministratorAccess. The cause was the Control Tower Region deny control. Here is how we proved it, enabled the region the supported way, and redesigned region governance in our landing zone.
An exchange API key with withdrawal rights on a bot host is a hot wallet with extra steps. This guide covers the controls we use for trading bot keys: least-privilege permissions, IP allowlists, sub-accounts, secret storage, rotation, logging without leaking signatures, and incident response.
Every POST to our Django admin returned 403 after we moved TLS termination to a Traefik ingress. Django compared the browser's https Origin with a request it believed was plain http. Two settings fixed it without weakening CSRF.
We moved twelve services from IRSA to EKS Pod Identity to simplify IAM. Three of them started failing with AccessDenied or fell back to the node role. Causes: a missing agent add-on on one node group, an old AWS SDK that did not know the new credential provider, and a trust policy without sts:TagSession.
In March 2025 the popular tj-actions/changed-files action was compromised and its version tags were repointed to code that printed CI secrets into workflow logs. Three of our repositories used it by tag. This is how we checked exposure, rotated secrets and moved to SHA pinning.
We designed a multi-tenant payment platform for debt-collection agencies: card and ACH, one-time and recurring plans, settlement offers, disputes and reconciliation. Here is how we kept PCI scope small, why the ledger is double-entry and immutable, and how retries stay safe.
We added five scanners to CI and within a week developers were merging with admin override. This is the gate design we rebuilt: block only new, fixable, high-signal findings on PRs, scan everything nightly, and make exceptions expire.
After upgrading to PyTorch 2.6, every checkpoint load in our evaluation pipeline failed with Weights only load failed. The default for weights_only in torch.load flipped to True, and our checkpoints contained a NumPy scalar. We fixed the checkpoints instead of turning the safety off.
Our PayPal checkout button rendered in development and staging but was an empty box in production. A new Content-Security-Policy set in Nginx blocked the PayPal SDK script, its iframes and its API calls. We fixed it per directive, with a nonce and a report-only rollout.
The Cyber Resilience Act is now law and the first deadline is in September 2026. For a team shipping connected devices on embedded Linux, this is what the regulation asks of the OS layer, how Yocto and Ubuntu Core each help or leave work to you, and a CI pipeline that produces the evidence.
An overview of Cloudflare's Free, Pro, Business and Enterprise plans, then a practical guide to everything the free tier offers a small team: DNS, CDN, Universal SSL, DDoS protection, WAF managed rules, rate limiting, Tunnel, Zero Trust, Pages, Workers, R2 and Turnstile, with a setup order.
Analysts had an explicit rwx ACL on a shared reports directory and still got Permission denied. A routine chmod 750 had quietly lowered the ACL mask, and files from the ETL job were born with a read-only mask. getfacl showed it all in one word: effective.
A developer committed a .env file with a live AWS access key, then deleted it in the next commit. The key stayed in history. We revoked it within 40 minutes, checked CloudTrail, rewrote history with git filter-repo and added scanning so it cannot happen again.
Our API certificate renewal looked perfect in desktop Chrome, yet the Android app, curl and a partner's Java service all rejected it. The server sent only the leaf certificate without the intermediate. Serving the full chain fixed every client at once.
An internal reporting service read the user ID and role from a JWT with jwt.decode(), which never checks the signature. A route that bypassed our gateway let any edited token through. We switched to verification with a pinned algorithm, issuer, audience and JWKS rotation.
Our deploy job worked on main and failed on the production environment with Not authorized to perform sts:AssumeRoleWithWebIdentity. Using a GitHub environment changes the OIDC subject claim. We rewrote the trust policy around exact subjects instead of wildcards.