Skip to main content -
The weekly limit alert that fired twice at 3:40 AM
-
172 accounts held a session length the settings page could not show
-
Our Pre-Deploy Name Check Only Read Text, and 13 Live Images Carried the Name
-
The photo upload rule we deleted was doing a second job
-
1,057 lines of security commit after an agent pasted live credentials into docs
-
Five Committers Billed for a CodeQL Scan That Last Ran May 22
-
A 200 Response Carrying Credentials Nobody Had a Ticket For
-
nanoid 3.3.18 sat in the queue for 15 hours under sanitize-html
-
267 Script Contexts, 33 Customer Inputs, and One Filter That Broke Uploads
-
A 6,375 Byte Response Showed Us the Login Exemption Was Wrong
-
The Safeguard We Trusted Guarded a Different Door
-
We Picked 150,000 Password Hash Iterations and the Platform Said No
-
A password setting of 150,000 passed build and type checks, then failed live
-
A Security Scanner Gave Our Windows Agent Setup a D at 57/100
-
The Office Got Banned by Its Own IPFilter After 1,500 Hits
-
Three New Doors Opened the Day a Wrong Byline Slipped Out
-
commit-9547 and the Null Posture That Skipped Every Permission Check
-
When Unset Quietly Meant Unrestricted on Every Restart
-
Why One Stored Password Produced Two Unrelated Error Messages
-
The customer's own scraper IS the bot swarm you've been fighting
-
Why a Sound Dashboard Endpoint Design Still Sat Behind a 401
-
A hash-chained manifest makes archive changes visible
-
Whack-a-mole is a real strategy: firewall blocks as a legitimate holding pattern
-
A six-file, 131-line change to stop ?k= from leaking
-
Two Sticky Notes on a Mailbox Called agent-queue and done
-
JS Detections: the one Pro-tier Cloudflare lever that actually catches HTTP-replay proxies
-
What We Built Before Letting Any Agent Write to the Archive
-
The Scrubber Ran Clean and a Username Still Shipped in the Frontmatter
-
Why a Clean Published Page Told Us Nothing About Our Session Archives
-
880 Tickets, One Iframe, and a Login Page the Watchdog Never Caught
-
The Published Page Looked Clean While Drafts and Logs Kept the Names
-
AwarioBot Pushed CPU to 80 Percent on Our Legacy App Box
-
A Trusted Gateway POST Is Still a Public Endpoint
-
We Fixed the Wrong Registration Bug and Found a Public Door
-
A restored organization of 327 units and the script we almost left armed
-
The Recovery Script That Stayed Armed After 327 Units Came Back