Search
Posts
Use the Primitive, Not the Patch: Closing a CodeQL Backlog by Class
When CodeQL keeps flagging js/file-system-race, the fix is one canonical primitive routed through one shared module. Eleven TOCTOU sites closed.
ReadOne Folder Was Behind Every Critical Dependabot Alert
When the only two manifests in your Dependabot queue belong to a folder your plugin never ships, the fix is to delete the folder, not patch it.
ReadTailscale Federated Trust: Scope to Auth Keys, Not All
Tailscale's federated trust lets a GitHub Actions OIDC subject do anything on your tailnet by default. A deploy only needs to create an auth key.
ReadPin the Installer and Add a Renewer
A CI tool that floats is a gate whose behaviour changes without a commit. Pin the installer, then add a renewer so the pin is refreshed by review.
ReadMove Deterministic Math Out of the LLM Prompt
Move date windows, site lists, and per-site totals out of the LLM prompt and into a Python file the wrapper reads before the prompt is built.
ReadRefuse to Substitute a Weaker Token in Scheduled CI
A scheduled CI workflow that falls back to a weaker token opens PRs that re-trigger no required checks. PR #1563 closes that fallback in update-npm-stats.yml.
ReadGit Plumbing for an Unattended Cron on a Shared Checkout
When an unattended cron has to commit to a shared, often-dirty checkout, git plumbing beats porcelain: hash-object + commit-tree + push survives concurrent sessions, behind-branch state, and push races.
ReadThree Self-Healing Classes for an Unattended AI Pipeline
Three self-healing classes keep an unattended AI pipeline quiet: repair rounds, depth-capped provider failover, and nightly catch-up of older dates.
ReadHustle P1: COPPA Delete, Cosign Slice 1, SQLite Race
SQLite PRAGMA busy_timeout fixed a Next build race widened by migration 0005; same day shipped parent delete plus export (COPPA) and per-signer co-signatures.
ReadNext.js 16 Hustle: Rate Limits and Admin Fail-Closed
Hustle shipped seven P0 security PRs in one day: SQLite rate limits, fail-closed admin, AUTH_URL fix, debug routes deleted. What landed and what broke.
Read