fourth post in the training tracker series: turning the AI coach spec into a running endpoint, the bugs that only showed up once something real was talking to it, a security gap closed before a second user existed, and a chat UI to finally use the thing.
second post in the training tracker series: before adding a single new feature, the working single-user app gets a proper security review. What an audit of a small web app actually looks at, and why shipping something is the start of the job, not the end of it.
A CISA contractor exposed credentials, config files, and access tokens in a public GitHub repository. I had a smaller incident with a similar pattern — and a very different blast radius — in April.
Cleaning git history removes data from your repo — but not from search engines, the Wayback Machine, or GitHub’s cache. Here is what to check.
After a security review flagged AWS identifiers committed to a public repo, we used git-filter-repo to scrub them from all 46 commits — including file content and commit messages.
A post-launch security review of tacedata.ca uncovered sensitive AWS identifiers committed to a public repository. This is a full account of what was exposed, how it was found, and what it took to fix it.