Türker Yıldırım

security

  • A secret mount is not an ARG, and history proves it

    Note2 min read

    A build argument is recorded in the image history whether or not the build used it, so a token passed as an ARG is readable by anybody who…

  • The staging environment that was lying

    Deep dive10 min read

    It passed on staging four times and failed in production four times. The same code, a different outcome, and five differences nobody had enumerated.

  • Redaction has to be structural, not a regex on the message

    Note2 min read

    A regular expression stripping card numbers from log lines works until the format changes, and it is applied after the value has already been passed around. Redacting by…

  • Environments and required reviewers as a deploy gate

    Note2 min read

    An environment attaches secrets and an approval requirement to a job, which puts the gate in the platform rather than in a convention. Scoping the secrets to the…

  • Verifying a signature needs the raw body

    Note2 min read

    A signature is computed over the exact bytes sent, and a framework that parses JSON into an array has already thrown those bytes away. Round-tripping through a decoder…

  • Pinning an action to a SHA rather than a tag

    Note2 min read

    A tag is a mutable pointer in somebody else’s repository, and a workflow referencing one runs whatever that pointer names today. This matters most for third-party actions, which…

  • Log lines that a machine can read

    Deep dive10 min read

    A grep that needed three regular expressions and a sort. A log line written for a person to read at leisure is not a record you can query.

  • Redis 6.2 GETDEL, for the one-shot token

    Note1 min read

    Reading a key and deleting it was two commands and a race, and 6.2 made it one. The race matters for anything single-use — a password reset token,…

  • terraform plan output leaks secrets into the log

    Note2 min read

    A plan prints the values it intends to write, and a pipeline that posts the plan to a pull request posts them to anybody who can see the…

  • The search cluster whose licence changed underneath us

    Deep dive14 min read

    A licence change in January is a legal event with an infrastructure bill attached. Four options, and the one that is not on the list.