Practical security / Original explainers
Handle secrets with less risk.
Plain-language field guides for developers and teams. Every guide focuses on decisions you can apply without buying a particular product.
Team practice · 3 min
Sharing credentials with contractors
Choose the right channel, limit scope, verify receipt, and close access cleanly.
Cryptography · 3 min
Why keys belong after the URL hash
Understand what browsers send, what servers log, and what fragments do not solve.
Delivery · 3 min
Stopping preview bots from burning one-time links
Design a human-confirmation gate without weakening deletion semantics.
Incident response · 3 min
How to rotate an exposed secret
Contain, replace, verify, revoke, and learn—without causing a second outage.
Decision guide · 3 min
Password manager, vault, or one-time link?
Match the tool to repeat access, automation, audit, and recipient constraints.
Development · 3 min
Handling .env files safely
Prevent local configuration from leaking into Git, chat, logs, and build artifacts.
Infrastructure · 3 min
Safe SSH key handoff
Prefer individual identities, constrain access, and verify before revoking bootstrap credentials.
Cloud security · 3 min
Service-account JSON without the sprawl
Replace long-lived downloaded keys with workload identity wherever possible.
System design · 3 min
Designing expiration and deletion
Separate read-once behavior from time-based expiry and make failure states observable.
Architecture · 3 min
Threat-modeling client-side encryption
See what zero-knowledge architecture protects—and the risks it leaves behind.