JJJeffrey Jorgenseninjeffreyjorgensen.hashnode.dev·5h ago · 18 min readFalsehoods engineers believe about moving moneyA penny I sent myself switched off the balance check. The coins went out to the network; nothing was debited. It wasn't a typo and it wasn't a missing check. It was a sentence I believed: an idempoten00
ASAbulAsar S.inabulasar.com·22h ago · 7 min readDebugging a False-Positive Hex Advisory in an Elixir CI PipelineIntroduction Recently, while working on a personal project in Elixir/Phoenix, I was performing what looked like a routine dependency update in an Elixir/Phoenix project: mix deps.update mint The comm40
VVaultKeepRinvaultkeepr.hashnode.dev·3h ago · 5 min readOpen Source vs Closed Source: Why Security Software Needs Code TransparencyThe Security Paradox in Modern Software When your password manager holds the keys to your digital life, trusting closed source code resembles handing your house keys to a stranger who won't tell you h00
ABAuth By Exampleinauthbyexample.hashnode.dev·4h ago · 1 min readA feature flag is not an authorization checkFeature flags are great for rollouts. They are a poor substitute for authorization. A flag answers: “Is this code path on for this cohort?” An authz check answers: “Is this principal allowed to do thi00
RMRenukashree Muraliinquietbytes.hashnode.dev·4h ago · 6 min readWhat Building a File Encryptor in Rust Taught Me About Authenticated EncryptionWhat this does A command-line tool that encrypts a single file with a password. Under the hood: Argon2id turns your password into a 256-bit key, AES-256-GCM encrypts the file with that key, and everyt00
JJJeffrey Jorgenseninjeffreyjorgensen.hashnode.dev·4h ago · 13 min readThe check that never failedFourteen measures that were present, had been reviewed, and were believed. None of them was working. Each entry says what it looked like from outside, and what it took to make it prove itself. A safeg00
ERErik Rekolainturva.dev·5h ago · 5 min readFive rounds before the agent signed anythingThe run was made on 15 September 2026 and the project is called Mandate Desk. An owner sets transfer caps, reviews the agent's exact plan, approves it for a limited window and can revoke the mandate. 00
ANAkshay Nazirkarinakshay25.hashnode.dev·5h ago · 8 min readCloud SQL in GCP Introduction Most applications need somewhere to store structured data. A web application may store user accounts, orders, payments, application settings, or analytics information inside a relational 00
ABAuth By Exampleinauthbyexample.hashnode.dev·9h ago · 1 min readLogged in is not a permissionA successful login answers one question: who is this? Authorization answers a different one: may this principal do this action on this resource right now? Treating "the user is authenticated" as enoug00
PPDF4meinpdf4me1.hashnode.dev·10h ago · 8 min readAPI Key or OAuth? Why a Document API Doesn't Need BothEvery new integration kicks off with the same fork in the road: does this API want an API key, or does it want OAuth? Most developers pick based on habit rather than the actual shape of the problem, a00
