Security

Design a qualification harness that keeps the first failure, accounts for uncertain resources, and publishes useful evidence without exposing secrets.

Defer application boot and filesystem authority until your CLI framework has validated that a mutating command will actually execute.

Keep login, logout, eligibility, credential upgrades, and HTTP permission checks behind the authentication services configured by your application.

Prove a machine publisher has the permissions it needs, and no broader authority, by exercising the registered tools it will actually call.

How Waaseyaa’s oauth-provider package added optional, additive configuration so a consumer that only needs a stable Google or GitHub identity can skip the email lookup, the forced consent prompt, and the offline refresh-token grant.

How Waaseyaa’s SessionCookiePolicy enforces the __Host- cookie prefix’s four constraints for both the session cookie and the CSRF double-submit cookie, and rejects misconfiguration at boot instead of failing silently in the browser.

How northway’s browser prototype keeps its API key off client JavaScript with a loopback-only Node proxy, before any of it reaches the production Pi build.

Mounting a durable volume straight onto the directory you chmod’d in the image throws away that permission — bake a private child path instead.

A shared runtime stage plus two build targets keeps CLI maintenance tools out of the deployed API image, and a script proves it on every build.

How a human-triggered ‘@claude review’ workflow got locked down to read-only, bounded-diff, revision-verified reviews after the official tag-mode example turned out to be implementation-capable by default.