Security

Go / 09 Sep 2026 / 8 min read

Control Structured Log Output in Go with slog.LogValuer

Passing a struct directly to slog is convenient until that struct grows a field that should never appear in logs. An access token, session secret, internal note, or large payload can turn an ordinary diagnostic line into a security problem or an expensive blob of noise. Go’s slog.LogValuer interface gives a type control over its own structured log representation. Instead of teaching every call site which fields are safe, you can define that representation next to the type and let slog use it wherever the value is logged.

Golang Logging

Python / 08 Sep 2026 / 12 min read

Process Template Strings Safely with Python T-Strings

Python’s f-strings are excellent when the desired result is immediately a string. That same immediacy becomes a limitation when an application needs to inspect interpolated values before deciding how they should be represented. Python 3.14 adds template string literals, usually called t-strings, for that boundary. A t-string looks much like an f-string, but it does not immediately collapse its literal text and interpolated values into one str. Instead, it produces a structured Template object from string.templatelib.

Python Security

Python / 08 Sep 2026 / 8 min read

Inspect ZIP Archives Before Extraction in Python

ZIP extraction looks like a single filesystem operation, but an archive is really a collection of filenames, metadata, and compressed byte streams supplied by whoever created the file. When the archive is untrusted, that metadata belongs at a trust boundary. Python’s zipfile module provides convenient extraction helpers, and those helpers include protections for suspicious path components. The documentation still warns against extracting untrusted archives without prior inspection. That distinction is useful: library normalization is not the same thing as an application-specific acceptance policy.

Python Standard Library

Go / 08 Sep 2026 / 7 min read

Contain Untrusted File Access in Go with os.Root

Applications often combine a trusted directory with a file name that came from somewhere less trusted: an HTTP request, archive entry, manifest, job message, or database row. The obvious implementation is also a common security boundary mistake: path := filepath.Join("./uploads", userName) f, err := os.Open(path) If userName can select a path outside ./uploads, the application may expose files it never intended to touch. Even careful string validation becomes harder when symbolic links and concurrent filesystem changes enter the picture.

Golang Security

Python / 03 Sep 2026 / 10 min read

Parse and Render Shell Arguments Safely with Python shlex

Command-line text looks deceptively simple. Splitting on spaces works until an argument contains whitespace. Concatenating strings works until a filename contains shell metacharacters. Logging a list of arguments works, but the result may be difficult for a human to copy and inspect. Python’s shlex module handles a useful middle ground: shell-like lexical analysis for Unix-style command text. Its split(), quote(), and join() helpers let programs move deliberately between a string representation and a sequence of argument tokens.

Python Standard Library

Software Engineering / 02 Sep 2026 / 10 min read

Designing Structured Logs for Production Debugging

Production debugging often starts with a deceptively simple question: what happened to this request? Plain-text logs can answer that question in small systems, but they become difficult to search reliably when message wording changes, multiple services participate in one operation, or operators need to aggregate millions of records. Structured logging addresses that problem by representing important context as named fields instead of embedding everything in prose. The goal is not to turn every variable into a log field. A useful log schema captures stable facts about an event, preserves enough correlation context to connect related work, and avoids recording data that creates security or privacy risk.

Software Engineering Observability

Linux / 01 Sep 2026 / 5 min read

Harden systemd Services with Security Directives

A systemd unit can do more than start and restart a process. It can also define a security boundary around the service by restricting filesystem access, Linux capabilities, namespaces, privilege changes, and resource consumption. These controls do not replace application security, but they can reduce the damage caused by a compromised or misbehaving process. Start from the service’s real requirements Hardening works best when it is based on what the process actually needs.

Linux systemd

Cybersecurity / Updated 10 Sep 2025 / 2 min read

How to Whitelist IP Address Ranges with .htaccess

.htaccess is useful for more than URL rewriting and caching. It can also provide an additional access-control layer, including restricting an application to specific IP addresses or IP ranges. This technique can be useful when: An application is still in development and should only be available to an internal team. You want to protect sensitive paths such as /admin or /api. A server should only be reachable from an office network or VPN. Whitelist One IP Address To allow only one IP address:

DevOps Security

Cybersecurity / Updated 10 Sep 2025 / 2 min read

How to Block IP Ranges with `.htaccess`

One useful feature of Apache is the flexibility of .htaccess. In addition to URL rewriting and caching rules, .htaccess can also restrict access based on IP addresses. If you are dealing with spam bots, brute-force attempts, or unwanted traffic from a particular network, one quick option is to block an individual IP address or an entire range. Block a Single IP Address To block one IP address, use: <RequireAll> Require all granted Require not ip 192.168.1.100 </RequireAll> This blocks 192.168.1.100 while allowing other clients to access the site.

DevOps Apache

Web Development / 03 Sep 2025 / 3 min read

Automatically Encrypting Eloquent Model Attributes

Applications often store fields that deserve additional protection at rest. Laravel can encrypt selected Eloquent attributes before they are written to the database and decrypt them automatically when they are read. For modern Laravel applications, the built-in encrypted cast is preferable to overriding Eloquent’s magic __get() and __set() methods. It integrates with the model casting system and avoids interfering with Eloquent internals. Basic Implementation Define encrypted attributes in the model’s casts:

Laravel Security

Cybersecurity / 03 Sep 2025 / 3 min read

.htaccess Rules to Prevent PHP Execution

Public upload directories are a common security-sensitive part of web applications. If an attacker manages to upload a file such as shell.php and the web server executes it, the upload feature can become a route to remote code execution. On Apache, a directory-specific .htaccess configuration can help prevent script execution in locations that should contain only static files. Why .htaccess Can Help Apache supports .htaccess files for directory-level configuration when the server permits the relevant overrides. This makes it possible to apply security rules to a specific directory without changing every virtual-host setting.

DevOps Security