Security

The security-sensitive parts of building software: getting secrets and credentials into the places that need them without leaking them, wiring up authentication, and the setup chores around both. This is the umbrella over secrets, credentials, and authentication, so each one has a single home and related skills cross-link here rather than each reinventing the handling.

Secrets

Getting a human-held secret into a destination (a CI secret, a Worker secret, a local config file) without it landing in the chat transcript, shell history, ps output, or disk.

Topics

• Collect Secrets: Reusable tool that prompts for a secret with hidden input and writes it to a GitHub repo secret, a Cloudflare Worker secret, or a gitignored .dev.vars file without leaking it. Use in any setup flow that needs a human-held secret to reach a destination.

HTTPS

Serving a service over HTTPS on a machine you operate, where the certificate is your responsibility rather than a platform's.

Topics

• HTTPS: Set up HTTPS for a service and keep it working without ongoing manual work — decide what terminates TLS (a platform often already does, in which case there is nothing to build), pick the ACME challenge the name allows, and install the renewal schedule before issuing so the first run exercises it. Covers the failure modes that look like success: a certificate nothing renews, a renewal nothing reloads, two things bound to port 443, and checks that pass on the host while remote clients fail. Use when a service needs HTTPS on a machine you operate.

See also

• Fix npm Vulnerabilities: Triage and remediate dependency vulnerabilities reported by npm audit.
• Deploy a Small Stateful Web App: Cloudflare Worker deployment whose Worker secrets are a collect-secrets.shwrangler destination.
• Server Startup: Binding the listener that terminates TLS, including dual-stack binding so an IPv4 port redirect reaches an IPv6 socket.