Notes from the workshop.
Engineering thinking, written down — on architecture, operations, and building software that lasts past its second year.
- September 4, 20264 min read
The part I don’t grade
Scan docks nyxoralabs.com for a CSP weakness I could fix, and ignores the one I can’t. Both of those were my decisions.
Read - August 28, 20263 min read
The floor that isn’t a floor
Recon renders its partial subdomain count as a floor. Checking the claim, the floor leaks in three places, and none of them show up in the number.
Read - August 20, 20263 min read
Small ranges, big claims
Recon reports coverage in three states, not two. The interesting part is what decides the state: not whether the request succeeded, but what the answer can support.
Read - August 13, 20263 min read
The bug that only exists after you deploy
A list of six deploy-only bugs, checked before publishing. Three of them weren’t true — the same mistake as the bugs themselves.
Read - August 6, 20262 min read
The guard was correct. Its scope was wrong.
Scan makes requests to whatever host you point it at, so it has a guard against reaching internal addresses. The guard was right. It just wasn’t covering the whole path.
Read - July 30, 20262 min read
A certificate check that worked on my machine and was dead in production
Scan flags certificates signed with SHA-1. The check ran perfectly in development and silently never fired on the deployed site, because the two run different versions of Node.
Read - July 23, 20262 min read
My scanner told me to add a DNS record that wouldn’t have helped
Sentinel checked a subdomain for a DMARC record, didn’t find one, and told me exactly what to add. Following that advice would have accomplished nothing.
Read - July 16, 20262 min read
The scanner said my own site was an F
Sentinel graded nyxoralabs.com an F. I’d already hardened it, so only one of us was wrong.
Read
Building something that has to last?
If durable, systems-focused engineering is what your project needs, start here.