TAG · 2 POSTS

#security

BUILD · 6 MIN

A Token Scoped To One Client Can't Touch Another's Queue

I pointed one client's API token at a different client's queue in production and got a clean 403. The exact schema, the audit that ran before the feature did, and the moment my own tool refused a shortcut I tried to take.

#build #security #agents #claude-code

SETUP · 5 MIN

Your First API Key, Without Leaking It

Pasting an API key into your code and pushing it to GitHub can drain your balance in minutes. The right way with a .env file and .gitignore, and what to do if you already leaked one.

#setup #security #api-keys