The cleanup tool that almost deleted its own hands
Reading an aws-nuke dry run: the screenfuls of red are harmless noise, and the real hazard is one quiet line in the middle of them.
Tags
36 pages
Security
The security finding you must not fix
A checkov finding you must suppress rather than fix: that KMS policy statement is the escape hatch that stops you locking yourself out for good.
A state bucket that defends itself
An OpenTofu state bucket that defends itself against corruption, deletion and its own operator, using lockfiles and prevent_destroy.
forbid means forbid, until linkme needs a word
forbid(unsafe_code) is absolute, which is a problem when a dependency emits a link_section the lint counts as unsafe. Where the line ends up.
A framework that contains no unsafe
Why every shipping crate uses forbid(unsafe_code) rather than deny, which any module inside it can quietly override from the inside.
A signing key needs somewhere to live
A checksum hosted beside your download stops accidents, not a compromised platform. Why the signing key has to live somewhere you control.
Waivers with an expiry date
A vulnerability scanner is a one-day yes or no. Running cargo-deny as a standing policy gate instead, with waivers that expire on a date.
Verifying your own downloads: how I solved it for self-updating CLI tools
Self-update integrity for a CLI: verify the downloaded binary against the release checksums file, and decide whether to fail open or closed.
The blank import that keeps a dependency out of your binary
Making OS-keychain support provably absent from a Go binary for regulated or air-gapped builds, using a registry and a blank import.
Where should a CLI keep your API keys?
Credential storage for a Go CLI: an env-var reference by default, an opt-in OS keychain, and plaintext only as a last resort and banned in CI.
