Passing a private repository token as a build argument writes it into the image history, where docker history reads it back out for anyone who can pull the…
A secret in an environment variable is visible in docker inspect, in the process environment and in any crash dump that prints the environment. The _FILE convention is…
A workflow triggered by pull_request from a fork has no secrets, deliberately. pull_request_target runs in the context of the base repository and does have them. Combining pull_request_target with…
A limit with no feedback means a well-behaved client cannot behave well — it finds out by being refused, and its only strategy is to retry. Retry-After is…
Buster defaults to the nftables backend with an iptables compatibility shim, so iptables -L and nft list ruleset can show different things and both are telling the truth.…
Managing authorized_keys across thirty servers means a configuration run to add a colleague and another to remove one, and the removal is the one that gets forgotten. Access…
Behind a proxy, $remote_addr is the proxy. Reading X-Forwarded-For instead is correct only if you also refuse to believe it from anyone but the proxy. This matters for…
Increasing the bcrypt cost or moving to Argon2 applies to new accounts only, because a stored hash cannot be upgraded without the plaintext — and the plaintext is…