Infrastructure
Keyless GitHub Actions Deploys to GCP with Workload Identity
Stop pasting service account JSON keys into GitHub Secrets. Workload Identity Federation lets Actions authenticate to GCP with short-lived OIDC tokens.
security
Tags
Security
Stopping Secrets Before They Get Committed to Git History
A secret committed to git lives forever, even after deletion. Here is a layered defense that blocks it before the commit, and how to rotate when one leaks.
Infrastructure
Three Layers That Keep Cloud Run Traffic Behind Cloudflare
A public run.app URL lets anyone bypass your CDN and hit Cloud Run directly. Three layers close that gap: ingress limits, load balancer, secret header.
Security
Prompt Injection Defense for Agents That Read Untrusted Text
An agent that reads web pages and files can be hijacked by hidden instructions inside them. Here is the architecture that stops prompt injection.
Backend
How to Rotate JWT Signing Keys Without Logging Everyone Out
Rotating a JWT signing key naively invalidates every live token and logs out all users. Here is the overlap window and kid design that avoids it.
Security
Least Privilege for CI Bots That Commit and Deploy Code
An automation bot with broad write and unlimited deploy rights turns one bad run into a whole-system failure. Here is how to shrink the blast radius.
Infrastructure
When Declarative Firewall Sync Prunes Rules and Cuts Access
A firewall sync pruned rules that only existed by hand and cut live traffic. Here is the postmortem, the root causes, and how to make prune safe.