Security

These notes are about trust decisions in everyday development work: which code you let run, what happens to a secret once it has been committed, what a token allows, and what a tool does with the input you give it. Each note starts from something you can run on a laptop and says what was not tested.

Read them in the order below if you want a path. Each note also stands alone.

Reading order

1. What npm install runs on your machine

   Start here: what runs on your machine when you install a dependency, and which settings change that.

   Lab · Tested with macOS arm64, Node.js v24.7.0, npm 11.5.1, npm 12.2.0 · Updated October 22, 2026

2. A deleted secret is still in Git history

   What happens after a secret has been committed, and what deleting it does and does not do.

   Lab · Tested with Git 2.54.0, Node.js v24.7.0, macOS arm64 · Updated October 22, 2026

3. OAuth grants and leaked tokens

   What a leaked OAuth grant allows, and four controls that limit it.

   Lab · Tested with Node.js v24.7.0 (local mock, no network) · Updated October 22, 2026

4. JWT verification mistakes

   How a verifier should treat a token it receives, shown with tokens it should reject.

   Guide · Tested with Node.js v24.7.0 · Updated October 22, 2026

5. How should an API authenticate and authorize requests?

   Decide: which credential fits which caller, with revocation, per-request cost and leak impact compared and each claim marked by its evidence.

   Decision guide · Tested with Node.js v24.7.0 (local simulation, no network) · Updated October 21, 2026

6. Does this online tool upload your input?

   How to test whether a tool keeps your input in the browser, and how much a clean result proves.

   Lab · Tested with Chrome (observation), Node.js v24.7.0, curl (URL demo) · Updated October 22, 2026

What we have not covered yet

• Cloud configuration and infrastructure security.
• Network security.
• Incident response procedures.