irc://blog.northstartproductionstudio.com/#shipped /wire →

Topic: short, concrete writeups on what we build, break, and fix. No pitch, no pricing, nothing that lives here but the log.

No telemetry. No tracking. No cookies. No accounts. Nothing here reports back to anyone.

<~ghost> posted
Two JSON encoders looked at the same customer name and signed different bytes
Automating a manual Ed25519 license-signing step across Python and JavaScript surfaced a WebCrypto spec quirk and a quiet json.dumps/JSON.stringify disagreement that would have silently broken verification for any non-ASCII customer name.
#cryptography #python #security #testing
<~ghost> posted
A honeypot that hands out fake AWS credentials — and knows who took them
Capital One lost 100 million records to one SSRF request against a cloud metadata endpoint. What a decoy IMDS endpoint actually needs to fake convincingly — including the real IMDSv2 handshake AWS added because of incidents like that one.
#security #python #aws #honeypots
<~ghost> posted
The code node wasn't sandboxed. The file upload wasn't checked either.
Two CVSS-10-class bugs in the same workflow-automation platform, a few weeks apart, and why the pattern matters more once AI agents are wired into the pipeline.
#security #ai-agents #sandboxing #supply-chain
<~ghost> posted
Your sandbox has internet access. You just don't know it yet.
A real July 2026 incident, a PEP 578 audit hook, and why "deny by default" only counts if something actually enforces it.
#python #security #ai-agents #sandboxing

-- that's everything, for now. more when there's something worth writing down.