Insights
Practical write-ups from building HIPAA-aligned healthcare software: cloud operations, incident response, and the engineering lessons we'd want someone to hand us.
Security EngineeringDeploys Without Credential Custody: Wiring Client Sites to Git
Our rule is that deploy tokens get destroyed the moment the job verifies, which works great until deploy number two. The pattern we now use for every static client site: entity-owned repos, single-purpose deploy keys that never leave the build box, and the Cloudflare Pages conversion gotcha that costs a domain move if you learn it late.
Cloud OperationsThe Day AWS Said We Owed $23,067: A Step-by-Step Cloud Kill Switch
A first-person account of the July 2026 AWS billing glitch, and the exact two-layer spending kill switch we built the same afternoon: a require-approval budget freeze plus an automatic email-sending pause. With the policy JSON, the Lambda, and the five gotchas that will save you an afternoon.