Türker Yıldırım

security

  • Composer 2.2 and the allow-plugins prompt

    Note2 min read

    2.2 in December stops running Composer plugins that have not been explicitly permitted, and a non-interactive install refuses rather than prompting. A Composer plugin runs arbitrary code during…

  • A dependency inventory generated in the pipeline

    Note2 min read

    An inventory maintained by hand is out of date the day it is written; one generated by the build is correct by construction. Three sources are needed because…

  • A deploy that can be undone in ninety seconds

    Deep dive10 min read

    The rollback plan was “redeploy the previous tag” and it took nineteen minutes. Rolling back is a build, and a build is not fast.

  • Answering ‘are we affected’ should take minutes

    Note2 min read

    The value of an inventory is entirely in query time, and a set of JSON files nobody can search is a compliance artefact rather than a tool. The…

  • Scanning a base image is half the answer

    Note2 min read

    A scanner reports what it can identify from package metadata, and a binary copied into an image during the build has none. The blind spots are consistent and…

  • A dependency inventory you can answer questions from

    Deep dive14 min read

    9 December, a Java vulnerability, and a stack with no Java in it. “Are we affected” took eleven hours to answer with confidence.

  • OIDC to the cloud, so the pipeline holds no long-lived key

    Deep dive10 min read

    A deploy key valid since 2018, in a settings page, with no expiry and no audit trail. A token exchange replaces it, if the trust is scoped narrowly.

  • An OIDC trust scoped to one branch

    Note2 min read

    The token exchange replaces a long-lived key with a short-lived one, and the value is entirely in how narrowly the trust is scoped. Omitting the subject condition means…

  • A rate limit zone in nginx costs one shared memory block

    Note2 min read

    Rate limiting at the web server is cheaper than in the application and protects the endpoints the application never gets to serve. burst without nodelay queues the excess…

  • A GitHub Actions workflow that other repositories can call

    Deep dive10 min read

    Eleven repositories with the same ninety-line workflow and eleven copies drifting. A fix applied to four of them.