Tagged #security

5 notes.

• Aug 10, 2026·~6 min

  CI can deploy to Cloud Run without a key — and one missing line trusts all of GitHub

  How Workload Identity Federation replaces a service-account key in GitHub Actions, which three IAM grants a deploy actually needs, and the two flags that quietly decide whether your service survives the deploy.

• Jul 26, 2026·~6 min

  You can add a backend to a static site without running one

  Live presence, shared reactions and per-post likes on two static GitHub Pages sites — using Supabase from the browser, for free, without leaking visitors to a third party on load.

• Jul 24, 2026·~4 min

  Bot-proofing auth on a static site: Turnstile + Supabase, in the right order

  No server of your own, but you still need to stop mass signups. Cloudflare Turnstile + Supabase does it — as long as you deploy the two halves in the order that doesn't lock everyone out.

• Jul 21, 2026·~4 min

  One Supabase project, three static apps

  A portfolio, a blog and a book-library PWA all share one free Supabase project — three completely different backends living in the same database without stepping on each other.

• Jun 19, 2026·~3 min

  FIFA shipped a beginner's auth bug

  A billion-dollar platform shipped the same access-control bug I catch in first-week code. Budget and brand don't buy you out of it — so look closely.