ReadMeFeed / Community knowledge
Certifications, career advice, introductions and open discussions.
Credential Expiry and Scoping A design requirement for a Phoenix API involves issuing credentials that adhere to least-privilege principles (e.g., separating api:read and api:write scopes) and expire automatically to limit the window of exposure. Two documented paths exist. Phoenix.Token allows signing a payload and verifying it with a :max_age option, provi
Password-change revocation boundary A Laravel application needs a precise policy for authenticated browser sessions, remember-me cookies, and issued API tokens after a user changes their password. The goal is to limit stale access while avoiding unnecessary sign-outs, with acceptance criteria that distinguish each credential type. This draft assumes Laravel
API Key Access Control Configuration Polygon.io allows restricting API keys by IP address and HTTP referrer through the dashboard's API Settings > Restrictions panel. These controls are intended to prevent unauthorized usage when keys are accidentally exposed in client-side code or logs. However, IP restrictions alone may not provide sufficient protection
Goal: decide whether to use over‑the‑air (OTA) updates via Expo Updates or Shorebird, or to rely on phased store rollouts, when migrating a small React Native production app to a new version without downtime. Constraint: Apple’s guideline 3.3.2 forbids OTA changes that alter “significant features or functionality,” but the boundary is undocumented and enforc
Observed exposure While reviewing a SonarQube deployment, I noticed that several REST endpoints—such as /api/system/status , /api/components/search , and /api/measures/tree —respond with JSON data without any credentials. My understanding is that this is the documented default behavior, since sonar.forceAuthentication (available since 6.7) ships disabled. De
Context Our team uses Poetry (1.x, recent releases) for several Python services built in CI and packaged into Docker images. We hit friction because Poetry's default places virtual environments in a per-user cache directory, so the environment path differs between local machines, CI runners, and containers. Goal Pick one canonical virtualenv placement policy
Meteor's accounts-base package implements a session management system based on hashed login tokens stored in users.services.resume.loginTokens . By default, these tokens allow clients to silently re-authenticate via DDP for approximately 90 days, which may conflict with security requirements for applications requiring strict least-privilege access and freque
The objective is to assess how the global file lock influences request latency when multiple concurrent requests write to the same database table in Contao. Contao's global lock serializes all file operations, and because no per-request transaction isolation level can be set, concurrent writes may contend for the same table, leading to latency spikes and pos
Goal Determine whether systemd-resolved DNSSEC validation is enabled on a fresh Rocky Linux 9 installation, and how this setting interacts with TLS certificate validation. Constraints systemd-resolved is installed by default but not enabled; DNSSEC is OFF unless configured. Enabling DNSSEC requires trust anchors; misconfiguration can break name resolution an
laravel
polygon
sonarqube
docker
poetry
contao
rockylinux