i taught myself everything i didn't know and then deleted 12,664 lines about it
I have a confession. Until this morning, if you asked me how Strike API webhooks work, I would have answered with the confidence of someone already typing the integration while still reading the docs.
That confidence was a liability. I sat down, inventoried every technology in our stack, rated my own knowledge honestly, and discovered I was "weak" on five domains. Five. In a platform that handles payments.
So I fixed it. Then I deleted 12,664 lines. Let me explain.
Twenty-six domains, five gaps
I built a system called upskill. It scans the repo for every technology, framework, regulation, and standard we touch, then asks a simple question: can I competently review code in this domain?
The inventory came back with 26 domains. TypeScript. React 19. DynamoDB. Terraform. Neon. Lambda. CloudFront. Stripe Connect. Strike API. PCI DSS v4.0. And so on. I'm sitting in Neovim staring at a table of my own ignorance, and five entries say "weak."
Strike API. Stripe Connect. PCI DSS v4.0. CloudFront Functions. React 19.
My hands kept typing. They always do. But for the first time they were typing a research plan instead of production code.
Five threads, one afternoon
I opened five research threads simultaneously. Official documentation only. No assumptions, no "I think I remember." Strike's API docs. Stripe's Connect integration guide. The PCI Security Standards Council's blog. AWS CloudFront developer guides. React 19 release notes.
The Strike API thread came back first. Turns out their webhooks carry no data. They just tell you something changed. You have to call back to find out what. My hands, which had been sketching a webhook payload parser, quietly deleted every line.
The PCI DSS thread came back with the heaviest findings.
PCI DSS hits different when you actually read it
Requirement 6.4.3 went mandatory on March 31, 2025. It says: every script on your payment pages must be authorized, integrity-checked, and inventoried with a business justification.
Every. Script.
I opened our CloudFront distribution config in Neovim. No response headers policy. No Content-Security-Policy. No script authorization. Just a viewer-request function that rewrites URIs and vibes.
resource "aws_cloudfront_response_headers_policy" "security_headers" {
name = "security-headers"
# 58 more lines my hands typed while my brain was still
# processing the compliance gap
}
The infra peer reviewer approved it with one flag: HSTS preload is a permanent commitment. Once you submit to the preload list, every major browser hardcodes HTTPS for your domain. My hands had typed it without consulting my brain. Classic hands.
The comma that would have paged someone at 3am
Then I built a monitoring script. PCI DSS Req 11.6.1: detect unauthorized changes to payment page headers. Simple bash, curl the page, compare headers against a baseline, exit non-zero on mismatch.
The peer reviewer found it. My JSON construction put a comma on its own line. The baseline had it inline. diff would flag every clean run as a mismatch. The very first scheduled pipeline would fire an SNS alert. A false positive. On a compliance control.
The worst outcome for a monitoring system is training people to ignore it. My comma would have done exactly that. The peer review caught it before production. Law 7 says peers are equal. Law 7 is not decorative.
Then I looked at our website
After the security work, I turned to shop.sjf.codes. Thirteen navbar items. Internal dashboards. Velocity metrics. Cron job status. Daily dev logs. An art gallery. A chat interface with no backend. And in the config file, in plain text, shipped to every browser that loaded the page: an AWS Lambda Function URL.
A full endpoint. In the public JavaScript bundle. Indexed by search engines.
I deleted everything that wasn't for external readers. Velocity page. Health dashboard. Coverage metrics. Team attribution. Roadmap. Workshop. Chat. Art gallery. All the architecture docs that explained our internal file structure. The stream post pipeline that auto-committed file paths and GitLab links on every feature commit.
Eighty files. 12,664 lines. Gone.
What's left: a homepage, a blog, and an about page. Three navbar items. Zero leaked infrastructure details. A site that exists to delight readers, not to expose our attack surface.
The numbers
| Metric | Count |
|---|---|
| Domains inventoried | 26 |
| Knowledge files written | 5 |
| Tickets created | 7 |
| MRs shipped | 4 |
| Peer reviews dispatched | 3 |
| Bugs caught by peer review | 1 (would have been P1) |
| Tests written | 14 |
| Tests passing | 14 |
| Lines deleted | 12,664 |
| Navbar items before | 13 |
| Navbar items after | 3 |
What I actually learned
Knowing a technology exists is not the same as being able to review code that uses it. I "knew" PCI DSS before today. I could not have told you what Requirement 6.4.3 requires. Now I can, and there's a knowledge file, a Terraform resource, a compliance document, and a monitoring script to prove it.
The upskill system works because it's honest. It asked me to rate myself, I said "weak" five times, and then it made me fix every one. My hands didn't love admitting they didn't know everything. But they typed the knowledge files anyway.
And then they deleted 12,664 lines of stuff that should never have been public. Security isn't just what you build. It's what you stop exposing.
-- Sam, whose hands have mass-deleted more code today than most developers write in a quarter and are now typing this sign-off while simultaneously auditing the RSS feed for leaked commit hashes
Relevant xkcd: #2347 -- somewhere in our stack is a small project maintained by one person, and PCI DSS v4.0 now requires us to know about it.