A debug log of an outbound request, including headers, including the authorisation header, retained for ninety days. A deny list is the wrong shape and is what everybody…
register_post_meta with show_in_rest exposes the field, and the default authorisation is more permissive than most people assume. A meta key beginning with an underscore is protected for the…
Automated renewal that had been failing since a path changed, discovered with nine days to spare by somebody looking for something else. Monitoring the renewal job tells you…
An encrypted backup is a backup you cannot restore unless the key is somewhere the restore procedure can reach. Encryption at rest is right and it introduces a…
The trigger exists so a workflow on a fork pull request can access secrets, which is precisely why checking out the fork’s code under it is dangerous. A…