Practices

Latest posts

• .github/workflows/deploy.ymlkiteline/web-app

  1permissions:2  id-token: write3  contents: read4steps:5  - name: Deploy to staging6    env:7      CRUNU_TOKEN: ${{ secrets.CRUNU_TOKEN }}8      CRUNU_SERVER: ${{ vars.CRUNU_SERVER }}9    run: exec crunu run --env web-app/staging -- npm run deploy

  CI/CD·October 27, 2026

  Giving CI only the secrets it needs

  Long-lived CI tokens work from anywhere until revoked. How to scope pipeline secrets, keep production out of CI, and bind tokens to a repo with OIDC.

• Reissue at providers (34)Removal: Tom HalvorsenTH

  EN~/.envpayments-api / productionSTRIPE_SECRET_KEYSTRIPE_WEBHOOK_SECRETDATABASE_URL+6

  AWS~/.aws/credentialspayments-api / productionAWS_ACCESS_KEY_IDAWS_SECRET_ACCESS_KEYWhere to reissue: AWS

  What’s been seen can’t be revoked: reissue any values the member may have copied at their providers.

  Teams·October 27, 2026

  An offboarding checklist for engineering teams

  Removing an account takes seconds. Secrets outlive it. A practical checklist for engineering offboarding, from sessions and tokens to reissuing values.

• ~/.stripe.envpayments-api / stagingstage

  owner’s signature verified

  STRIPE_SECRET_KEY••••••••Show

  STRIPE_WEBHOOK_SECRET••••••••

  view 1 of 1

  Teams·October 27, 2026

  Sharing a secret with a contractor safely

  Contractors need real credentials for real work. How to hand one over without leaving it in chat forever, and how to end their access cleanly afterwards.

Example. Kiteline is a fictional company.