Renewing Proton Pass CLI PAT Sessions with macOS Keychain
Proton Pass PAT sessions expire after two hours, but a scoped PAT in the macOS login Keychain can renew them without exposing it in shell history.
Today I Learned#proton-pass#macos#keychain
Why pnpm audit --fix=update kept a vulnerable nanoid behind an auto-installed peer
A pnpm peer-resolution path dropped the update depth, retained nanoid 3.3.16, and made a full lockfile and node_modules refresh the clean no-override fix.
Development#pnpm#supply-chain#dependency-managementWhat Changed in pnpm Since 11.7 Until 11.13.1
Seven pnpm releases shipped between 11.7 and 11.13.1, and the one that maps to my config is a peak-memory fix for the minimumReleaseAge and trustPolicy resolution path.
Development#pnpm#supply-chain#securityA Cognito token-pair contract: API Gateway authorizer, Spring, Hono, and PowerSync
How one Cognito user pool serves four client surfaces through a shared token-pair contract, a REQUEST Lambda authorizer, and defense-in-depth re-validation that isolates a new mobile client without duplicating identity.
Development#aws#cognito#securitySelf-hosting Renovate on GitLab CI
Running Renovate as a scheduled GitLab CI job instead of the hosted GitHub App: the execution model, the token strategy, config validation in CI, and the tradeoffs accepted at each step.
Development#security#supply-chain#renovateCodifying a pnpm audit remediation SOP into an agent skill
After re-deriving the same pnpm audit remediation decision tree across five JS trees one too many times, I packaged it as an agent skill that runs the process instead of rediscovering it.
Development#pnpm#supply-chain#agentsGondolin sandboxing for AI coding agents: two tiers from tool-only to full clean room
A two-command setup that runs the pi coding agent with either tool-only filesystem sandboxing or full clean-room isolation, each tier matching a different threat model.
Development#pi#gondolin#securityProton Pass CLI: Replacing Shell-Wide Secret Exports with Process-Isolated Injection
How I moved API key exports from eager shell startup to lazy, process-isolated injection using pass-cli run.
Development#proton-pass#security#shellClosing Renovate's transitive-CVE blind spot
Renovate's vulnerability alerts only cover direct dependencies in npm and pip. Here is the CI-gate and manual-remediation pattern that catches the rest, and why I run Renovate without Dependabot.
Development#security#supply-chain#renovateWhat Changed in pnpm Since 11.1.2 Until 11.7.0
Six pnpm releases shipped while my project was frozen at 11.1.2. Two of them added security controls I should have adopted sooner.
Development#pnpm#supply-chain#securityFixing zizmor findings without suppressions
Three fix patterns for common zizmor findings: creating environments via gh api, hardening git auth with remote set-url, and replacing third-party actions with native commands.
Development#zizmor#security#supply-chainzizmor's auditor persona surfaces findings the default persona hides
Running zizmor --persona=auditor surfaced six findings across two repos that the default persona and --pedantic flag both missed.
Today I Learned#zizmor#security#supply-chainUpgrading Payload CMS 3.85.0: from 12 audit vulns to zero
A systematic approach to eliminate every known vulnerability and replace pnpm monkey-patches with proper supply-chain configuration.
Development#payload-cms#pnpm#supply-chainHardening a Renovate Config for Supply Chain Security
Closing supply chain gaps in an existing Renovate setup with OSV scanning, SHA pin protection, and cooldown alignment complementing pnpm's minimumReleaseAge.
Development#security#supply-chain#renovateAutomated Dependency Updates with Supply Chain Security
How to set up Renovate or Dependabot with cooldown policies that complement pnpm's minimumReleaseAge: automated patches without opening the door to compromised packages.
Development#security#supply-chain#renovateBeyond Version Checks: Provenance and Behavioral Security
Lockfiles, cooldowns, and exclusion lists are necessary but not sufficient. Provenance verification and behavioral analysis catch the attacks they miss.
Development#security#supply-chain#provenanceKeeping Supply Chain Exclusions Honest
Your pnpm security config decays over time. minimumReleaseAgeExclude entries pile up, trustPolicyExclude entries become stale, and allowBuilds lists drift from reality. Here's how to catch it.
Development#security#supply-chain#pnpmSupply Chain Security with mise and pnpm
Trying to survive in the JS minefield
Development#security#supply-chain#mise