Security and operations
45 posts on security and 40 on devops, organized around what you decide before something happens: where secrets live, how a backup gets restored, which dependency gets in.
Recommended reads
View moreClaude API Key Security: Why .env Is Not Optional
Pasting a Claude or DeepSeek API key straight into your code "just to test it quick" leaves a trail in your git history and your logs. A no-nonsense guide to environment variables, rotation, and what to check before sharing a repo.
Sep 09 2026 · 7′ · Tutorials · nextjs · anthropic
Sniffnet: How Much Traffic Are My AI Agents Generating Behind My Back
I installed Sniffnet to check what network traffic Cline and background LLM API calls actually generate. Here's what the tool shows you, and what you can't conclude from a single observation session.
Sep 07 2026 · 8′ · Tutorials · agentes-ia · networking
Cline on Autopilot: Why I Put Limits on My Agent
Cline lets you auto-approve every action the agent takes without asking permission. The button exists. The question is why, as an architect, I'd rather not touch it — and what hidden cost total autonomy has in a real codebase.
Sep 02 2026 · 7′ · Tutorials · AI agents · arquitectura de software
Docker Says "Healthy" and the Pod Keeps Sending Broken Traffic
Docker's HEALTHCHECK is information, not a routing guarantee. If Kubernetes or Swarm isn't reading it, your container can be "healthy" and still keep taking requests that are going to fail.
Aug 28 2026 · 7′ · Tutorials · docker · devops
Actuator Endpoints in Spring Boot: Allowlist, Don't Just Disable the Obvious Ones
Spring Boot Actuator exposes more by default than most teams realize. The difference between an endpoint that's useful for monitoring and a map of environment variables handed to an attacker comes down to a decision almost nobody makes explicitly: allowlist versus disabling what looks obvious.
Aug 23 2026 · 8′ · Tutorials · spring-boot · java
Stateless JWT vs stateful sessions: the framework I use to choose in identity systems
Stateless JWT isn't the universal answer tutorials promise. If your system needs immediate revocation or fine-grained auditing, state isn't the enemy — it's the solution. Here's the decision framework I use in real identity systems.
Aug 18 2026 · 9′ · Tutorials · seguridad · JWT