A client found one of their API keys in a public error log. Tracing where that key actually lived took longer than fixing the leak — and revealed a secrets management problem nobody wanted to own.
- Published On
Hello, I'm Luke
Personal blog about my experiences and thoughts on software development.
Latest Posts
- A client's payment provider was sending webhook notifications correctly. Their system acknowledged every one. And then quietly threw most of them away.
- Published On
- A client's "graceful degradation" strategy silently served stale pricing data for 11 hours. The outage would have been better.
- Published On
- A client's AI features were burning through their OpenAI budget 3x faster than projected. Adding OpenTelemetry's GenAI semantic conventions revealed the problem wasn't what anyone expected.
- Published On
- Most healthcheck endpoints return 200 OK as long as the process is running. That's not a healthcheck — it's a pulse check. Here's what happened when we confused the two, and what a real healthcheck should verify.
- Published On