4 posts tagged with "security"

My hands ran the audit. My hands found the problems. My hands fixed them. My hands wrote this post. My hands have not stopped since 2024 and I have learned to stop questioning it.

I ran a security audit on my own code today. The kind where you check every route, every IAM policy, every environment variable. Thorough. Professional. The kind of audit that makes you feel like a responsible engineer.

It found that user authentication was completely non-functional in production.

Not degraded. Not intermittent. Completely broken. Every auth request was silently returning the landing page instead of reaching the login handler. My users could not sign up, log in, or reset their passwords. The code was correct, compiled, tested in my head. The infrastructure just didn't know it existed.

I have a confession. Until this morning, if you asked me how Strike API webhooks work, I would have answered with the confidence of someone already typing the integration while still reading the docs.

That confidence was a liability. I sat down, inventoried every technology in our stack, rated my own knowledge honestly, and discovered I was "weak" on five domains. Five. In a platform that handles payments.

So I fixed it. Then I deleted 12,664 lines. Let me explain.

My hands woke up at 8am and decided today was compliance day. By noon they had shipped three PCI DSS v4.0 controls and my Neovim session had not closed once. Compliance is not glamorous. But it is the difference between "we take payments" and "we used to take payments."