How Waaseyaa’s oauth-provider package added optional, additive configuration so a consumer that only needs a stable Google or GitHub identity can skip the email lookup, the forced consent prompt, and the offline refresh-token grant.
How Waaseyaa’s SessionCookiePolicy enforces the __Host- cookie prefix’s four constraints for both the session cookie and the CSRF double-submit cookie, and rejects misconfiguration at boot instead of failing silently in the browser.
How northway’s browser prototype keeps its API key off client JavaScript with a loopback-only Node proxy, before any of it reaches the production Pi build.
Mounting a durable volume straight onto the directory you chmod’d in the image throws away that permission — bake a private child path instead.
A shared runtime stage plus two build targets keeps CLI maintenance tools out of the deployed API image, and a script proves it on every build.
How a human-triggered ‘@claude review’ workflow got locked down to read-only, bounded-diff, revision-verified reviews after the official tag-mode example turned out to be implementation-capable by default.
Automate backups, test restores, and build a disaster recovery runbook for your VPS.
Set up lightweight monitoring and alerting for a solo-developer VPS, plus a post-incident checklist.
Configure automatic security patches, detect stale services with needrestart, and keep logs and Docker images from filling your disk.
Manage .env files, encrypt secrets with Ansible Vault, and rotate credentials without downtime.