https://stiubhart.com/notes/Technical notes on production systems, platform security and operational judgement.https://stiubhart.com/notes/operational-scar-tissue/https://stiubhart.com/notes/operational-scar-tissue/Wed, 01 Jul 2026 00:00:00 GMTProduction experience is not just knowing tools; it is knowing how systems fail once real users, attackers, deploys and incidents are involved.https://stiubhart.com/notes/security-controls-signal/https://stiubhart.com/notes/security-controls-signal/Wed, 24 Jun 2026 00:00:00 GMTA useful control should make abuse more expensive while also telling operators what changed and whether the control is working.https://stiubhart.com/notes/fail-open-not-fail-unsafe/https://stiubhart.com/notes/fail-open-not-fail-unsafe/Wed, 17 Jun 2026 00:00:00 GMTSome controls should fail open, but only when the surrounding system can observe, constrain and recover from that decision.https://stiubhart.com/notes/long-lived-credentials/https://stiubhart.com/notes/long-lived-credentials/Wed, 10 Jun 2026 00:00:00 GMTRotation helps, but the bigger win is removing standing secrets and replacing them with scoped, short-lived identity.https://stiubhart.com/notes/rate-limits-detection-controls/https://stiubhart.com/notes/rate-limits-detection-controls/Wed, 03 Jun 2026 00:00:00 GMTRate limits are often sold as blockers, but their operational value is frequently in the abuse signal they produce.https://stiubhart.com/notes/replay-challenge-tokens/https://stiubhart.com/notes/replay-challenge-tokens/Wed, 27 May 2026 00:00:00 GMTSilent challenges are only as useful as the system’s ability to reason about replay, token scope and downstream verdicts.