Sourced write-ups on .env files, CI tokens, offboarding, contractors and audit logs, and on what a server that stores only ciphertext can and cannot see.
FeaturedSecurity
An audit log is only evidence if nobody can quietly edit it. How hash chains make tampering visible, what they miss, and how to check an export yourself.
Security7 min read
Read the articleCI/CD
Long-lived CI tokens work from anywhere until revoked. How to scope pipeline secrets, keep production out of CI, and bind tokens to a repo with OIDC.
Teams
Removing an account takes seconds. Secrets outlive it. A practical checklist for engineering offboarding, from sessions and tokens to reissuing values.
Security
Most tools separate dev and prod with permissions the server enforces. Why the boundary is stronger when each environment has its own encryption key.
Example. Kiteline is a fictional company.
Servers
A .env file on a server outlives every deploy and ends up in backups. How an agent with a lease delivers secrets from memory, and what it cannot hide.
Self-hosting
Docker on a VPS, Cloudflare Workers, Vercel or Cloud Run? What changes between platforms for a blind-server vault, and the two decisions you make only once.
Teams
Contractors need real credentials for real work. How to hand one over without leaving it in chat forever, and how to end their access cleanly afterwards.
Security
A blind server is a precise claim with precise limits. What Crunu's server stores, what it cannot do even if compromised, and what it still sees.
Security
With a password and a Secret Key, nobody at the vendor can open your account, or reset it. How the Emergency Kit works, and what to do when something is lost.
Secrets
Pasting a .env file into chat feels harmless. Where those values end up, why they outlive the conversation, and how to clean up what is already there.