-
Certificates Without the Jargon
X.509 certificates in plain language. Keys, CSRs, self-signed versus CA- signed, trust stores, and what actually matters when you generate certs for tools and tests.
Security Tools
-
Practical CLI design for open-source tools. Flags and arguments, exit codes, stdout versus stderr, helpful errors, and interfaces that feel good in scripts and in human hands.
Engineering Tools
-
What coding standards actually cover, why they save review time, and how to enforce them with linters, formatters, CI checks, editor settings, and hooks instead of nagging.
Engineering Standards
-
Practical configuration design for tools. Flags, environment variables, files, precedence, secrets, and defaults that stay understandable as projects grow.
Engineering Tools
-
When and how to ship a CLI tool as a container. Pinning base images, running as non-root, keeping the attack surface small, and avoiding container anti-patterns for simple utilities.
Security Tools
-
Contributing Without the Drama
How to open issues and pull requests people actually want to merge. Small diffs, clear context, real reproduction steps, and knowing when an argument is not worth having.
Open Source Community
-
The strategic parallels between cybersecurity and chess. Reading your opponent, adapting when the board changes, keeping tactics in service of strategy, and taking risks you have actually priced.
Security Strategy
-
Practical dependency hygiene for small teams and open-source projects. Pinning, lockfiles, audits, supply-chain basics, and keeping your supply line trustworthy without enterprise ceremony.
Security Engineering
-
How to retire APIs and flags without ambushing anyone. Warnings people actually see, version gates they can plan around, cheap migrations, and removals that happen on purpose.
Open Source Engineering
-
How to keep project documentation alive. Examples as tests, docs sites that ship with releases, screenshots that stay honest, and habits that stop docs from quietly lying.
Documentation Open Source
-
Encrypting secrets inside Git repositories. When git-crypt and similar tools help, where key management goes wrong, and safer patterns for small teams.
Security Git
-
Practical error handling for CLIs and libraries. Clear messages, exit codes, retries, typed failures, and when to crash versus recover.
Engineering Tools
-
Practical Git workflows for small teams and solo maintainers. Trunk- based development, short-lived branches, pull requests, and release tags without enterprise branching theatre.
Engineering Process
-
Build a working CI/CD pipeline with GitHub Actions, from a first build- and-test workflow to deploying an artefact, with the YAML to copy and the habits that keep workflows fast and safe.
CI/CD GitHub
-
Practical input validation for CLIs and small services. Paths, URLs, subprocesses, sizes, and the failure modes that let an attacker steer your tool.
Security Engineering
-
The key lifecycle for small security tools. Generate, distribute, rotate, revoke, and retire cryptographic keys and certificates without drama.
Security Engineering
-
Hardening CI/CD credentials. Short-lived tokens, OIDC, protected environments, and the GitHub Actions patterns that keep long-lived secrets out of your pipelines.
Security CI/CD
-
A plain-language guide to open-source licenses for people publishing tools. MIT, Apache-2.0, and the GPL family, what each one asks of your users, and how to choose without a law degree.
Open Source Community
-
How open-source maintainers stay in the game. Write down scope, decline without writing an essay, publish honest support expectations, and protect review time before it runs out.
Open Source Community
-
Mutual TLS and client certificates in practice. How they differ from ordinary HTTPS, when they are worth the trouble, and how small tools should issue and verify them.
Security Certificates
-
Observability for Small Projects
Practical observability for CLIs, libraries, and small services. Useful logs, health signals, failure modes, and knowing what broke without needing an enterprise APM stack.
Engineering DevOps
-
A practical SECURITY.md playbook for small projects. What to include, example structure, scope statements, and making the security policy easy to find and follow.
Security Open Source
-
Why the principles underneath programming outlast any single language, and how a grip on algorithms, data structures, and design makes picking up new syntax the easy part.
Engineering Fundamentals
-
Your README is the product page for an open-source project. Install steps that work, examples that ran, badges that tell the truth, and the shortest path from curiosity to a first success.
Open Source Documentation
-
What Red Teams and Blue Teams actually do, why running them against each other finds the weaknesses a questionnaire never will, and where Purple, Green, and White Teams fit around them.
Security Ops
-
How to make releases boring. Tags as the source of truth, changelogs people can read, scoped publishing tokens, and CI guardrails that stop a bad release before it reaches a registry.
CI/CD Open Source
-
Lightweight reproducible builds for small tools. Pinning inputs, killing nondeterminism, and getting to bit-for-bit or near-identical releases without enterprise ceremony.
Security Engineering
-
Responsible Dependency Updates
A practical cadence for dependency updates. Dependabot-style PRs, ignore rules, reading majors, and keeping upgrades boring without ignoring security fixes.
Security Engineering
-
How to match languages, operating systems, cloud providers, frameworks, and databases to what a project actually needs, instead of forcing one familiar stack onto every problem.
Tools Engineering
-
What static and dynamic application security testing each catch, why they find different bugs, and how to run SAST in CI and DAST against a deployed environment without drowning the team in findings.
Security Engineering
-
What counts as a secret, the five ways secrets management usually goes wrong, and the practices and tools that keep credentials out of your codebase and under control.
Security DevOps
-
Designing secure defaults for tools and libraries. Fail closed, least privilege, dangerous features opt-in, and interfaces that make the safe path the easy path.
Security Design
-
Practical secure logging for tools and services. What never to log, redaction, crash reports, debug flags, and keeping observability from becoming a leak.
Security Engineering
-
Security by Design in practice. The principles behind it, why fixing flaws at design time is cheaper, and what it looks like applied to software, infrastructure, and cloud environments.
Security Design
-
Security Disclosures That Work
Practical security disclosure for small open-source projects. SECURITY.md, private reporting, triage, credit, and promises maintainers can actually keep.
Security Open Source
-
Semantic versioning as it actually plays out in open-source tools. What counts as breaking, how to live in 0.x honestly, why changelogs are part of the version number, and how to keep upgrades boring.
Open Source Engineering
-
Practical supply-chain signing for open-source releases. Checksums, signatures, provenance, and verification steps users can actually follow.
Security Open Source
-
Why high coverage can be a vanity metric, how to test behaviour instead of mocks, and how small open-source projects can build a test suite that catches real regressions without drowning contributors.
Engineering Testing
-
A map of the colour-coded cybersecurity teams. Red, Blue, Purple, Green, Yellow, Orange, and White, what each one is responsible for, and how they fit together into one security programme.
Security Ops
-
Why capable engineers waste time polishing things that should not exist, how to tell warranted optimisation from busywork, and how first principles thinking keeps improvements pointed at something that matters.
Engineering Mindset
-
Threat Modelling for Small Tools
Lightweight threat modelling for CLIs, libraries, and small services. Assets, attackers, trust boundaries, and a practical checklist without enterprise ceremony.
Security Engineering
-
What continuous integration and continuous delivery buy you, what they cost, and the concrete guardrails (feature flags, staging, monitoring, canaries, rollbacks) that make automatic deployment survivable.
CI/CD DevOps
No articles match the current filters.
Try clearing the search or choosing a different tag or status.