Blog
Notes on keeping secrets secret
Plain-language writing on how credentials leak, and what actually stops it.
Why a CLI should never ask for your password
The device flow lets a command-line tool sign in without ever seeing a credential. Here is how it works, and the one way it gets phished.
Read article →What "AES-256-GCM encrypted" actually guarantees
Encryption at rest is a real protection with a precise boundary. Knowing where that boundary sits is what lets you trust a claim that uses the phrase.
Read article →How .env files end up in git history, and why deleting them is not enough
A committed secret stays in history after the file is removed. Here is how the leak usually happens and what actually fixes it.
Read article →