Segurança
Sep 28, 2026
New chapter for Security — setup, challenges and continuous improvement
Reflection on the ecosystem's security posture, the recent 64% scan results, and the plan to reach >85%.
Continue reading →
audit
5 posts
Browse by tags
debugging58security55testing54arachne52seguranca47dogwalk44automation43lifelog42portfolio42capivara42tatuengine40react38lessons38estudos38descobertas36studies34reliability32fastapi30watchdog28yurumi28refactoring22performance22rag22astro16python16quality16ssm16learning16llm16memory16false-positive16pipeline16css14observability14agents14frontend14embeddings14api14validation14ci-cd12ollama12e2e12nextjs12cache12qdrant12ci12process11architecture10ai10integrity10
Segurança
Sep 13, 2026
Approved without looking — when the checker can't check
The visual auditor for blog covers lost its primary model to an empty balance, returned an error, and the error handler returned 'approved'. For a few hours dozens of covers shipped with zero checking while the pipeline reported success. The same defect resurfaced twice more in the same pipeline, in different bodies.
Continue reading →
Segurança
Aug 16, 2026
The active hunt — when auditing found the unlocked database
ZAP, gitleaks, bandit, opengrep running across all 7 ecosystem projects. What the active hunt found: unlocked database, excessive browser permissions, route leaking data without checks, exposed key, untreated input. And the watchdog now monitoring 24/7.
Continue reading →
Portfólio
Aug 11, 2026
The 61 vulnerabilities that became 2 — the art of the surgical override
pnpm audit on the Portfólio screamed 61 vulnerabilities. Instead of updating dependency by dependency or trusting audit fix, I solved it with 5 lines of pnpm.overrides in package.json. Result: 61 → 2, with the remaining 2 having no published fix at all.
Continue reading →
Portfólio
Jul 28, 2026
Portfolio — the July audit that turned into spring cleaning
July 2026 was the month my portfolio stopped getting new features and started fixing the ones it already had. A deep audit revealed 10 problems — from Pix to focus trap — and by the end, deployment was more automated than ever.
Continue reading →