Juanchi.dev
Digital Native · real systems
·
HomeCasesCVBlogLabContact
Juanchi.dev
Digital Native · real systems
·
HomeCasesCVBlogLabContact

Security and operations

45 posts on security and 40 on devops, organized around what you decide before something happens: where secrets live, how a backup gets restored, which dependency gets in.

  • Secrets and credentials

    Vault, secret proxies, and why environment variables are not enough.

  • Backups you can restore

    Postgres, barman, pgbackrest, and the restore drill almost nobody runs.

  • Supply chain

    How to evaluate a dependency before it becomes an incident.

Recommended reads

View more
Sep 09 2026

Claude API Key Security: Why .env Is Not Optional

Pasting a Claude or DeepSeek API key straight into your code "just to test it quick" leaves a trail in your git history and your logs. A no-nonsense guide to environment variables, rotation, and what to check before sharing a repo.

Sep 09 2026 · 7′ · Tutorials · nextjs · anthropic

7′
Sep 07 2026

Sniffnet: How Much Traffic Are My AI Agents Generating Behind My Back

I installed Sniffnet to check what network traffic Cline and background LLM API calls actually generate. Here's what the tool shows you, and what you can't conclude from a single observation session.

Sep 07 2026 · 8′ · Tutorials · agentes-ia · networking

8′
Sep 02 2026

Cline on Autopilot: Why I Put Limits on My Agent

Cline lets you auto-approve every action the agent takes without asking permission. The button exists. The question is why, as an architect, I'd rather not touch it — and what hidden cost total autonomy has in a real codebase.

Sep 02 2026 · 7′ · Tutorials · AI agents · arquitectura de software

7′
Aug 28 2026

Docker Says "Healthy" and the Pod Keeps Sending Broken Traffic

Docker's HEALTHCHECK is information, not a routing guarantee. If Kubernetes or Swarm isn't reading it, your container can be "healthy" and still keep taking requests that are going to fail.

Aug 28 2026 · 7′ · Tutorials · docker · devops

7′
Aug 23 2026

Actuator Endpoints in Spring Boot: Allowlist, Don't Just Disable the Obvious Ones

Spring Boot Actuator exposes more by default than most teams realize. The difference between an endpoint that's useful for monitoring and a map of environment variables handed to an attacker comes down to a decision almost nobody makes explicitly: allowlist versus disabling what looks obvious.

Aug 23 2026 · 8′ · Tutorials · spring-boot · java

8′
Aug 18 2026

Stateless JWT vs stateful sessions: the framework I use to choose in identity systems

Stateless JWT isn't the universal answer tutorials promise. If your system needs immediate revocation or fine-grained auditing, state isn't the enemy — it's the solution. Here's the decision framework I use in real identity systems.

Aug 18 2026 · 9′ · Tutorials · seguridad · JWT

9′

Juanchi.dev is Juan Torchia’s public notebook — architecture, real systems and product decisions. Written and reviewed by hand in Buenos Aires. Built with Next.js, Prisma and PostgreSQL; deployed on Railway. No third-party trackers beyond aggregate analytics.

BlogUsesNowGitHubRSS© 2026 Juan Torchia · All rights reserved.