Articles

AI agent skills are dependencies. Declare them in one reviewed file, pin them to a version, enforce the license gate in code, and check for drift — the same discipline you already apply to packages.

A signed link keeps a file's address secret. It does not check who opens it. Here is why sensitive downloads increasingly ask for a hardware key, and how to add that step without turning every file into a chore.

Most teams that gate sensitive files end up with two credential systems: one for logging in, one for downloading. We built the other arrangement — one security key, enrolled once at the identity provider, authorising both — and the build taught us three things worth passing on.

If a download has to be authorised by a security key, something has to check the key. Making your file service a second relying party is one answer; verifying what the identity provider asserts is the other. The second is federation, and it changes what you verify, what you may call it, and how long it stays true.

An AI-attribution policy is a sentence in a contributing guide until something reads the author field. We had the policy, we had the check, and a bot-authored commit still merged clean. What we found fixing it.

A gate that fails on clean work and a security finding nobody can ever clear do the same damage: they teach the people watching to stop watching. Three cases from one week, why volume was never the problem, and the three practices that came out of it.

Six defects found in one evening on one platform. None crashed. Every deployment reported success, and several had been running that way for weeks. What they had in common, and the three habits that found them.

We found an OAuth service account carrying the administrator role and expected to find a privilege leak. There wasn't one — simple_oauth had been ignoring that role all along. Then we nearly took the site down proving it.

GraphQL rejects a query in its entirety if a single selected field is gone. Rename one Drupal field and every page running that query goes blank at once — while TypeScript, the build, and CI all stay green. Here is the gate we added.

Our preview pipeline validated its token, enabled draft mode, and rendered a node — then served the published version. Every layer reported success. The bug was one line that read a flag and did nothing with it.

Config Split keeps env-specific configuration out of the canonical sync directory, but running drush cex while a split is active deletes the split-owned files from config/sync. The safe model: hand-edit the split's member lists, verify with cim instead of cex, and route per-environment values through settings.php overrides rather than the split.

A git-ignored path repository that symlinks a registry module to a local checkout writes a path dist into composer.lock. Commit that lock and every CI job and image build fails, because the sibling directory only exists on your machine. Relock with the override set aside, and add a CI guard that rejects a path dist.

An interrupted docker compose up leaves an orphaned, hash-prefixed container squatting a service name, so every later deploy fails to recreate it until someone removes it by hand. Adding --remove-orphans (or a pre-clean) lets the deploy heal its own stack instead of failing on state left by a previous run.

On a JSON:API or REST write, Drupal checks field edit-access against the stored value, not the incoming one — so a field-access gate governing what an agent may set sees the wrong value. The right seam is a validation constraint, which runs on the parsed entity and can compare the incoming value against policy across every transport.

How to expose a health endpoint that gives the public a coarse up/degraded roll-up while unlocking full per-service detail only to a server-to-server caller holding a shared secret. Covers constant-time comparison, private caching, fail-closed defaults, and a deploy-order-safe rollout.

A locale rewrite forced onto http: is cross-origin behind an HTTPS proxy, so Next re-issues it as an external request that re-enters the proxy and 301-loops the homepage. It passes every local test because the loop only appears when X-Forwarded-Proto: https is set. The fix: mark the internal rewrite with a per-process secret so canonicalization skips it.

Deleting a Drupal module's code is the easy part. Doing it without breaking your next automated deployment takes a two-phase migration — here's the pattern, and the production incident that taught it to us.

Binding a value into a signature is necessary but not sufficient. If the way you serialize claims before signing is ambiguous, an attacker can reshape a request so a bound claim silently disappears — and the signature still verifies. The pitfall, a concrete example, and the rule that prevents it.

A production-only 500, a green staging run, and a one-line fix: how X-Forwarded-Proto turns a Next.js middleware rewrite into a TLS handshake against a plaintext port — and how to reproduce and prevent it.

Infrastructure-as-Code makes government environments auditable, reproducible, and rebuildable from the repository — and adopting it does not require a disruptive migration.

A working definition of sovereignty in federal IT — data, operational, and architectural — and the questions that test whether a technology stack actually achieves all three.

Why federal agencies are decoupling Drupal: security isolation for the editorial backend, cleaner USWDS integration, and multi-channel delivery from a single content API.