AI didn't kill curl's bug bounty. The bounty did.
The cash prize for anything that looked like a finding was the accelerant, and AI only made plausible-looking reports free to produce.
Tags
41 pages
Security
Routing security findings without the noise
Routing AWS GuardDuty and Security Hub findings so an alert still means something: forward high severity only, and drop the duplicates.
Hardening the account that will hold the keys
Applying a security baseline to a fresh AWS account: audit logging, config recording, threat detection and an operator role that is not root.
No access keys in CI
Replacing long-lived AWS access keys in CI with OIDC federation, so the pipeline mints a short-lived token instead of holding a secret.
Secrets that scrub themselves from RAM
Storage answers where a secret lives, not what happens to it in memory. Wrapping secrets so they redact in Debug and zero on drop.
The cleanup tool that almost deleted its own hands
Reading an aws-nuke dry run: the screenfuls of red are harmless noise, and the real hazard is one quiet line in the middle of them.
The security finding you must not fix
A checkov finding you must suppress rather than fix: that KMS policy statement is the escape hatch that stops you locking yourself out for good.
A state bucket that defends itself
An OpenTofu state bucket that defends itself against corruption, deletion and its own operator, using lockfiles and prevent_destroy.
forbid means forbid, until linkme needs a word
forbid(unsafe_code) is absolute, which is a problem when a dependency emits a link_section the lint counts as unsafe. Where the line ends up.
A framework that contains no unsafe
Why every shipping crate uses forbid(unsafe_code) rather than deny, which any module inside it can quietly override from the inside.
