10 posts on Security.
A companion Streamlit food-delivery app from the same July 2022 DBMS mini-project week. Same MongoDB Atlas cluster, plus a PlanetScale token in main.py and admin.py. Hardcoded admin PIN in the panel. f-string SQL every query. The full pattern.
About 90 lines of Python, one Procfile, a Selenium instance that stops working every time LeetCode changes a Tailwind class, and a MongoDB Atlas connection string I committed in plain text. All of it educational.
A 110-line Selenium script that logs into the Cyberoam captive portal at 172.17.0.1:2280. Also a public repo where I committed my roll number as my password. Both are educational.
A 265-line Streamlit food-ordering demo. Users lived in MongoDB Atlas, orders lived in MySQL. Both connection strings were plaintext in main.py, in a public repo, since 2022. Also f-string SQL, because it was a lab.
Two MongoDB Atlas connection strings and a PlanetScale password turned up while I was writing retrospective posts on old college repos. A wider sweep added a fourth public Atlas cluster and a pile of finds in private repos I first mis-framed as public. Corrected.
An honest look at the RCA agent on my HANA VM. What the shared-secret design gets wrong, what the guardrails cover, and what still scares me.
The multi-agent PR scanner I built in March. What it caught on its own, what it kept missing, and where the human still had to make the call.
Why I stopped hardcoding API keys in .env files and built CipherStack. The four-state machine behind LRU vending, and the PostgreSQL lock that saved it under concurrency.
The LRU state machine is one component. This is the whole vault, Postgres AEAD rows, the Fly.io API, cert handshake, dashboard, and the /metrics endpoint.
Why I stopped shipping Python to 9,000 Linux servers, what static linking buys at fleet scale, and how a stripped Go binary beat the container it replaced.
