Journal
Occasional writing on technology culture, digital life, work, money, education, and public issues.
Journal articles
Page 2 of 17Pin GitHub Actions by commit SHA without losing updates
Pinning third-party actions to a full commit protects against mutable tags, while automated update PRs keep the pinned revision maintainable.
GitHub Actions OIDC to AWS: deploy without stored access keys
OIDC lets a workflow exchange a signed identity token for short-lived AWS credentials constrained by repository, branch, and environment claims.
SLO burn-rate alerts: page on fast and slow failures
Multi-window burn-rate alerts catch severe outages quickly while still detecting smaller sustained errors before the error budget disappears.
OpenTelemetry baggage: useful context without leaking PII
Baggage propagates across service boundaries, so include only small allow-listed routing context and never user secrets or unbounded identifiers.
Audit logs that attackers cannot silently rewrite
A tamper-evident log links ordered records with hashes and stores checkpoints outside the writer’s normal mutation path.
File upload security: inspect content, not only extensions
A filename and Content-Type header are caller-controlled, so uploads need size limits, safe storage names, content inspection, and isolated processing.
Cursor pagination tokens: sign filters and sort state
An opaque cursor should encode the stable sort position and relevant query state so clients cannot alter hidden filters or page across inconsistent ordering.
Multi-tenant API authorization: never trust tenant_id from JSON
Tenant identity must come from authenticated authorization context and constrain every query, not from a caller-controlled request field.
Refresh token rotation: detect reuse without logging everyone out
Rotating refresh tokens limits replay when the server tracks token families and treats reuse of an old member as a compromise signal.
202 Accepted APIs: job status, retries, and cancellation
A 202 response means work was accepted, not completed, so return a durable job URL and define terminal failure, expiry, and cancellation states.
Problem Details RFC 9457: consistent API errors
Problem Details gives errors a stable media type and fields, but applications still need safe extension names and machine-readable domain codes.
Optimistic concurrency with ETags and If-Match
ETags let an API reject an update based on stale state instead of silently overwriting another user’s newer change.
API idempotency keys: store status codes and response bodies
A completed idempotency record should replay the original status and response, while an in-progress record should prevent concurrent execution.
Webhook replay protection: timestamp windows and event IDs
A valid signature proves message integrity, not freshness, so webhook receivers also need a timestamp window and durable event deduplication.
Test agent permissions with deny-first scenarios
Agent tests must prove that disallowed actions fail, because successful happy-path tests say nothing about the permission boundary.
Prevent secret leakage through AI tool error messages
Tool errors returned to a model should contain actionable categories but not raw headers, connection strings, tokens, or private database values.
Handle partial failure in multi-step AI agent plans
An agent plan is not a transaction; completed external actions may need explicit compensation when a later step fails.
Record an audit trail for every agent tool call
Agent logs should connect user intent, model decision, approved parameters, tool result, and final state without storing unnecessary private prompt content.
Protect multi-agent workflows from confused-deputy bugs
One agent must not borrow another agent’s stronger permissions simply by writing a convincing message into shared context.
Sandbox coding agents without giving them production secrets
A code agent should operate in an isolated workspace with minimum credentials, restricted networking, and no default path to production.
Add human approval gates to high-impact agent actions
Approval should show the exact action, target, and changed data at the moment before execution rather than asking for vague permission at the start.
Stop prompt injection from documents reaching agent tools
Retrieved text is untrusted data, not authority, and must never grant itself permission to call tools or reveal secrets.
Design MCP tool schemas that agents cannot misunderstand
A precise tool schema narrows ambiguous actions by using enums, bounded values, descriptive fields, and separate preview and commit operations.
Authenticate an MCP server before exposing private tools
An MCP connection is not trusted merely because a client can reach it; the server must authenticate the caller and authorize every tool independently.
Rate limit expensive AI endpoints by user and workload
Request count alone is a weak limit for AI because two calls can differ by thousands of tokens and minutes of tool execution.
Redact PII from AI logs without losing debugging context
AI logs can contain names, account data, documents, and secrets, so observability must capture decisions and timings without copying raw private content.
Design an AI evaluation set that catches regressions
A useful evaluation set contains real failure cases, expected properties, and stable scoring rules rather than a few prompts that always look impressive.
Version embeddings without breaking vector search
Changing an embedding model changes vector meaning, so old and new vectors should never be mixed in one unexplained similarity space.
Build an AI model fallback without hiding quality failures
A fallback model can improve availability only when the application records why routing changed and verifies that the cheaper model can satisfy the same contract.
Set a token and cost budget for every AI feature
A production AI endpoint needs a per-request ceiling and a monthly feature budget before higher traffic turns a useful prototype into an uncontrolled bill.