5 posts filed under Security, newest first.
Porting a Claude Code safety tool from Linux to macOS turned into six weeks of discovering that nearly every failure mode on the new platform was silent, and that the tool's own adversarial test suite was the only reason I could see any of them.
A live payment key in a tracked `.env` file. The repository had `.env` in its `.gitignore`, and had done for two years.
Everybody wants to build the new thing, but the web runs on old software that somebody unglamorous is keeping alive, usually for free and usually without being thanked.
A site I built in 2018 was serving malware by the summer of 2021, and nobody involved did anything wrong, and that's what I find hard about it.
A build broke on a Tuesday. The cause was four levels down the tree, in a package maintained by one person, which I had not chosen and could not have named.