TaggedGetaggt mit#security

5 notes.5 Notizen.

• Aug 10, 2026·~5 min

  One missing line, and all of GitHub can deploy to your project

  Passwordless CI needs two scopes: the identity provider names the repository, and IAM limits who may impersonate the deploy account.

• Jul 26, 2026·~5 min

  You can add a backend to a static site without running one

  A "who else is here" room and per-post likes on two sites that have no server at all — and nothing at all connects until the visitor asks it to.

• Jul 24, 2026·~3 min

  I locked myself out of my own app with one toggle

  A static site can protect signup without its own server, but enabling enforcement before the client update locks everyone out.

• Jul 21, 2026·~4 min

  Three small apps can share one Supabase project

  Three small apps can share one Supabase project safely if schemas stay additive and browser keys are treated as public.

• Jun 19, 2026·~3 min

  FIFA shipped a beginner's auth bug

  A billion-dollar platform shipped the same access-control bug I catch in first-week code. Budget and brand don't buy you out of it — so look closely.