[{"data":1,"prerenderedAt":458},["ShallowReactive",2],{"blog-post-detail-i-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-pko8":3,"blogs-all-posts-detail-suggestions-en":28,"blog-comments-i-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-pko8-en":393},{"status":4,"source":5,"data":6},"success","markdown-file",{"id":7,"title":8,"slug":9,"lang":10,"category":11,"categorySlug":12,"summary":13,"excerpt":13,"author":14,"date":15,"readTime":16,"image":17,"tags":18,"publishedAt":22,"createdAt":22,"updatedAt":22,"filePath":23,"sourceUrl":24,"content":25,"seoTitle":26,"seoDescription":13,"canonicalUrl":27},"cron-1786954320913","I Automated My Entire GitOps Security Stack. The First Thing It Blocked Was My Own Salary.","i-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-pko8","en","Kubernetes","kubernetes","I Automated My Entire GitOps Security Stack. The First Thing It Blocked Was My Own...","Le Beltagy","17\u002F8\u002F2026","6 phút","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Frvjfi7ee0tmi1xp1mem5.png",[11,12,19,20,21],"security","gitops","devops","2026-08-17T08:12:00.911Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fi-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-pko8.md","https:\u002F\u002Fdev.to\u002Fle_beltagy\u002Fi-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-227e","\n# I Automated My Entire GitOps Security Stack. The First Thing It Blocked Was My Own Salary.\n\n*From \"zero-trust hero\" to \"I can't deploy my own payday fix\" — how I chained kube-radar, admission webhooks, and ArgoCD into an autonomous security pipeline, the regex that deemed me a threat, and why your guardrails become prison bars when you forget the escape hatch.*\n\n---\n\n## The Setup\n\nIt started with a single YAML file that should never have made it to production.\n\nI was reviewing a pull request for VehicleMetrics at 10 PM on a Thursday. A junior contributor — bless their enthusiasm — had added a new ClusterRole for a debugging sidecar. It looked innocent enough:\n\n```yaml\napiVersion: rbac.authorization.k8s.io\u002Fv1\nkind: ClusterRole\nmetadata:\n  name: vehiclemetrics-debug\nrules:\n- apiGroups: [\"*\"]\n  resources: [\"*\"]\n  verbs: [\"*\"]\n```\n\nCluster-admin in a trench coat. One `kubectl apply` away from \"we don't know who owns this cluster anymore.\"\n\nI caught it because I was *looking*. But what about the PRs I don't review? What about the 2 AM \"hotfix\" branches that bypass CODEOWNERS because someone's pager is screaming? What about the Helm chart I copy-pasted from Stack Overflow that binds a service account to `pods\u002Fexec` — the permission that lets anyone `kubectl exec` into a running pod and dump environment variables?\n\nI manage Kubernetes at Siemens professionally. I run bare-metal clusters in my closet obsessively. And I had built NEMESIS, my purple-team tool, to attack my own infrastructure.\n\nBut I had never built something to **stop the attack before it started**.\n\nSo I did what any engineer with too much caffeine and a weekend would do: I automated the entire security review pipeline. No human in the loop. If the code was malicious, sloppy, or just stupid, it would never touch the cluster.\n\nThe system worked perfectly.\n\nThen Friday at 4:47 PM happened.\n\n---\n\n## Why Not Just Use Branch Protection?\n\nYou're thinking: *this is a git problem, not a Kubernetes problem.*\n\nBranch protection, CODEOWNERS, required reviews — I had all of it. Here's why it's not enough:\n\n**1. YAML is a liar**\n\nThat wildcard ClusterRole? It passed `yamllint`. It passed `helm lint`. It passed a human reviewer who was looking at 14 files in a 3,000-line PR. The danger wasn't in the syntax. It was in the **semantics**.\n\n**2. Security is boring until it's catastrophic**\n\nNobody wants to be the reviewer who blocks a PR for three hours debating whether `pods\u002Fexec` is necessary. So they approve it. I know because I've done it.\n\n**3. \"LGTM\" is not a security control**\n\nA thumbs-up emoji doesn't enforce least privilege. A required reviewer count doesn't understand RBAC. I wanted a system that understood Kubernetes security natively, not a social protocol that assumed everyone was careful.\n\n---\n\n## The Stack I Built\n\nI took three tools I already trusted and wired them into ArgoCD's deployment pipeline:\n\n```plaintext\nGitHub PR\n    │\n    ▼\ngitops-validator (GitHub App)\n    ├─ kube-radar scan → RBAC wildcard \u002F overprivilege detection\n    ├─ NEMESIS static analysis → container image CVE + misconfig\n    └─ kyverno-lite webhook → policy enforcement (custom rules)\n    │\n    ▼\nArgoCD PreSync Job\n    └─ admission-controller validates the rendered manifests\n    │\n    ▼\nCluster (only if all gates pass)\n```\n\n### Tool 1: kube-radar (my own Go CLI)\n\nI wrote this when I was learning Go. It parses Kubernetes RBAC resources and scores them by risk. Wildcards = instant block. `pods\u002Fexec`, `secrets\u002F*`, `clusterroles\u002F*` without namespace restriction = flag for human review.\n\nI containerized it and turned it into a GitHub Actions job.\n\n```yaml\n# .github\u002Fworkflows\u002Fgitops-security.yml\njobs:\n  rbac-scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n      - name: kube-radar scan\n        uses: docker:\u002F\u002Fghcr.io\u002Fle-beltagy\u002Fkube-radar:v0.3\n        with:\n          args: scan --path .\u002Fmanifests --severity critical --fail-on-critical\n```\n\n### Tool 2: NEMESIS static analysis\n\nThe same purple-team engine that lives in my cluster as a DaemonSet has a `scan` mode. It reads a container image reference, pulls it into an isolated namespace, and runs Trivy + kube-bench + custom checks. If the image contains a known CVE with CVSS > 7.0, the pipeline fails.\n\n### Tool 3: kyverno-lite (custom admission webhook)\n\nI didn't need all of Kyverno's DSL. I needed four hard rules:\n\n1. No container runs as root\n2. No image uses `latest` tag\n3. No RBAC rule has `*` on apiGroups, resources, AND verbs\n4. Every deployment must have `resources.requests` set\n\nSo I wrote a lightweight admission webhook in Go — just 400 lines — using `controller-runtime`. It receives `AdmissionReview` requests from the Kubernetes API server and returns `allowed: true\u002Ffalse`.\n\n```go\n\u002F\u002F webhook.go — the RBAC gatekeeper\nfunc validateRBAC(req *admissionv1.AdmissionRequest) bool {\n    var role rbacv1.ClusterRole\n    json.Unmarshal(req.Object.Raw, &role)\n\n    for _, rule := range role.Rules {\n        \u002F\u002F Rule 3: The \"Deadly Asterisk\"\n        if slices.Contains(rule.APIGroups, \"*\") &&\n           slices.Contains(rule.Resources, \"*\") &&\n           slices.Contains(rule.Verbs, \"*\") {\n            return false \u002F\u002F ❌ DENIED\n        }\n    }\n    return true \u002F\u002F ✅ ALLOWED\n}\n```\n\nI packaged it as a `ValidatingWebhookConfiguration`:\n\n```yaml\napiVersion: admissionregistration.k8s.io\u002Fv1\nkind: ValidatingWebhookConfiguration\nmetadata:\n  name: gitops-security-webhook\nwebhooks:\n  - name: rbac.gitops.lebeltagy.io\n    rules:\n      - operations: [\"CREATE\", \"UPDATE\"]\n        apiGroups: [\"rbac.authorization.k8s.io\"]\n        apiVersions: [\"v1\"]\n        resources: [\"clusterroles\", \"roles\"]\n    clientConfig:\n      service:\n        name: gitops-webhook\n        namespace: security\n        path: \"\u002Fvalidate-rbac\"\n    failurePolicy: Fail\n    admissionReviewVersions: [\"v1\"]\n    sideEffects: None\n```\n\n`failurePolicy: Fail`. This is the critical line. If the webhook is down, **nothing gets deployed**. I wanted security over availability. I would regret this later.\n\n---\n\n## The ArgoCD Integration\n\nArgoCD has a feature most people ignore: **PreSync hooks**. You can run a Kubernetes Job before any sync operation. If the Job fails, the sync aborts.\n\nI created a PreSync Job that:\n1. Renders the Helm chart\n2. Runs kube-radar against the rendered manifests\n3. Runs NEMESIS against the container images referenced in the manifests\n4. Sends a Slack notification with the scan results\n\n```yaml\napiVersion: batch\u002Fv1\nkind: Job\nmetadata:\n  name: gitops-security-gate\n  annotations:\n    argocd.argoproj.io\u002Fhook: PreSync\n    argocd.argoproj.io\u002Fhook-delete-policy: HookSucceeded\nspec:\n  template:\n    spec:\n      containers:\n        - name: validator\n          image: ghcr.io\u002Fle-beltagy\u002Fgitops-validator:v1.2\n          env:\n            - name: REPO_URL\n              value: \"https:\u002F\u002Fgithub.com\u002Fle-beltagy\u002Fvehiclemetrics\"\n            - name: TARGET_REVISION\n              value: \"HEAD\"\n      restartPolicy: Never\n```\n\nIf this Job exits with code 0, ArgoCD deploys. If it exits with code 1, the sync is blocked and the Application shows `SyncFailed`.\n\nI tested it on a deliberately bad PR — that wildcard ClusterRole from the beginning. The pipeline caught it. The PR was blocked. The cluster stayed safe.\n\nI felt like a god.\n\n---\n\n## Friday, 4:47 PM\n\nIt was the last workday of the month. Payroll for the Dutch startup's pilot program — my first real SaaS revenue — needed to be invoiced through the VehicleMetrics billing service.\n\nThe billing service had a bug. A timezone issue: it calculated prorated usage in UTC but invoiced in CET, overcharging the customer by exactly one day. The customer noticed. I needed to ship a fix before 5 PM or the invoice would go out wrong.\n\nI wrote the fix in 12 minutes. One line changed in a Python utility. Tests passed. I pushed, merged, and watched ArgoCD.\n\nThe PreSync Job started.\n\nIt failed.\n\n```console\n[gitops-validator] ERROR: kube-radar detected CRITICAL violation\n[gitops-validator] File: manifests\u002Fvehiclemetrics-billing-sa.yaml\n[gitops-validator] Resource: ServiceAccount\u002Fvehiclemetrics-billing\n[gitops-validator] Issue: Binds to ClusterRole with pods\u002Fexec permission\n[gitops-validator] SEVERITY: Critical — automatic block enabled\n[gitops-validator] Exit code: 1\n```\n\nWait. What?\n\nI hadn't changed anything in `vehiclemetrics-billing-sa.yaml`. That file had been in the repo for weeks. Why was it failing *now*?\n\nI checked the git diff. The billing fix was a one-line Python change. No RBAC touched. But the PreSync Job scans the *entire rendered manifest tree*, not just the diff. And kube-radar had a new rule I had merged the night before — version v0.3 — that now flagged `pods\u002Fexec` as critical, not just a warning.\n\nThe rule change was good. The ServiceAccount *was* overprivileged. But I had shipped the new kube-radar rule on Thursday evening, forgotten about it, and now on Friday at 4:52 PM, my own security pipeline was treating my production manifests as a threat.\n\nArgoCD showed `SyncFailed`.\n\nThe billing fix was not deployed.\n\n---\n\n## 4:55 PM: The Panic Override\n\nI had two choices:\n\n**Option A:** Fix the RBAC properly — create a restricted Role with only the necessary permissions, update the ServiceAccount binding, run the tests, commit, push, wait for the pipeline.\n\nEstimated time: 20 minutes. It was 4:55 PM. The invoice batch job ran at 5:00 PM.\n\n**Option B:** Bypass the security pipeline and force the sync.\n\nArgoCD lets you do this. You can click \"Sync\" with \"Prune\" and \"Replace\" checked. You can skip the PreSync hook. I am an admin. I have the power.\n\nI hovered over the button.\n\nAnd I realized: if I bypassed my own security gate the first time it inconvenienced me, the entire system was theater. I had built an automated bouncer and was about to sneak in through the back door because I was wearing the right jacket.\n\nSo I didn't.\n\n---\n\n## 5:03 PM: The Real Fix (And The Bug I Actually Shipped)\n\nI spent 8 minutes — invoice job be damned — writing a proper Role:\n\n```yaml\napiVersion: rbac.authorization.k8s.io\u002Fv1\nkind: Role\nmetadata:\n  name: vehiclemetrics-billing\n  namespace: vehiclemetrics-prod\nrules:\n- apiGroups: [\"\"]\n  resources: [\"pods\"]\n  verbs: [\"get\", \"list\"]\n- apiGroups: [\"\"]\n  resources: [\"pods\u002Flog\"]\n  verbs: [\"get\"]\n```\n\nRemoved `pods\u002Fexec`. Removed the ClusterRole binding. Applied the principle of least privilege.\n\nCommitted. Pushed. Pipeline passed. ArgoCD synced at **5:02 PM**.\n\nThe invoice job? It ran at 5:03 PM. With the correct timezone fix. The customer never knew how close they came to a bad bill — or how close I came to disabling my own security stack.\n\nBut here's the part that haunts me:\n\n**The original `pods\u002Fexec` permission wasn't even needed.** It was a copy-paste from a debugging session three weeks ago. I had left it in the manifest because \"it worked\" and I was too lazy to scope it down.\n\nMy security pipeline didn't create a problem. It **revealed** a problem I had been ignoring. The thing that blocked my salary was the thing that was already wrong.\n\n---\n\n## The Aftermath: 48 Hours of Paranoia\n\nI spent the weekend reviewing every manifest in the repo. Here's what I found:\n\n| File | Issue | Risk |\n|------|-------|------|\n| `debug-namespace\u002Frole.yaml` | `verbs: [\"*\"]` on ConfigMaps | Any pod can read secrets mounted as ConfigMaps |\n| `monitoring\u002Fsa.yaml` | ServiceAccount bound to `cluster-admin` | Prometheus can read all secrets |\n| `temp\u002Fbackup-job.yaml` | Container runs as root | Privilege escalation vector |\n| `ingress\u002Ftraefik-rbac.yaml` | `apiGroups: [\"*\"]` on 3 resources | Over-scoped for ingress needs |\n\nFour critical issues. In my own repo. That I had written or approved.\n\nWithout the automated gate, they would have stayed there until someone exploited them — or until a compliance audit found them and I had to explain why a billing service could exec into pods.\n\n---\n\n## What I Changed (The No-Escape-Hatch Problem)\n\nThe system was right to block me. But the system was also dangerous because it had **no emergency override** that didn't require me to become a liar.\n\nHere's the architecture now:\n\n```plaintext\nGitHub PR\n    │\n    ▼\ngitops-validator (GitHub App)\n    ├─ kube-radar scan → CRITICAL = block PR\n    ├─ NEMESIS scan → CRITICAL = block PR\n    └─ kyverno-lite webhook → policy check\n    │\n    ▼\nArgoCD PreSync Job\n    └─ Full validation rerun\n    │\n    ▼\nValidatingWebhookConfiguration (cluster gate)\n    │\n    ▼\nCluster\n```\n\n**The fix:** I added a `@security-override` label. If a PR is labeled with this, the pipeline still runs, still reports every violation, but emits a **warning instead of a block**. The label can only be applied by a GitHub Team called `security-admins`, which has exactly one member: me. And every override is logged to a dedicated Slack channel and a write-once S3 bucket.\n\nI also changed `failurePolicy: Fail` to `failurePolicy: Ignore` on the admission webhook, with a twist: if the webhook is unreachable, ArgoCD flags the Application as `Unknown` and pauses automated syncs. Security is enforced when healthy. Availability is preserved when degraded.\n\n```yaml\nwebhooks:\n  - name: rbac.gitops.lebeltagy.io\n    # ...\n    failurePolicy: Ignore  # Don't crash deploys if webhook is down\n```\n\nBut the real fix wasn't technical. It was procedural:\n\n> **I stopped treating \"works\" as the standard. \"Least privilege\" is the standard.**\n\n---\n\n## The Numbers\n\n| Metric | Before (manual review) | After (automated gates) |\n|--------|----------------------|------------------------|\n| RBAC violations in prod | 4 known, unknown unknowns | 0 (all caught in CI) |\n| CVEs deployed to cluster | ~3 per month (after-the-fact scans) | 0 (blocked in PreSync) |\n| Time to review a PR | 45 min avg (human) | 3 min (automated) + human for exceptions |\n| False positive rate | N\u002FA | ~5% (tunable via severity threshold) |\n|Times I almost disabled my own salary | 0 | 1 |\n\n---\n\n## What I'd Do Differently\n\n### 1. Don't ship new scanner rules on Thursday night\n\nIf you're changing what \"critical\" means, do it Monday morning when you have the week to deal with the blast radius. Not the day before you might need to deploy a hotfix.\n\n### 2. Every guardrail needs a documented escape hatch\n\nNot a secret backdoor. A visible, audited, tightly-scoped bypass. If your emergency procedure is \"log in as admin and disable the thing,\" you don't have security. You have security theater with an intermission.\n\n### 3. Scan the diff, not the world\n\nThe PreSync Job originally scanned the entire manifest tree. Now it scans only the Helm release diff: what *changed*, not what *exists*. Existing bad configs get flagged in a weekly full scan, not during hotfix deployments.\n\n### 4. Your production manifests are dirtier than you think\n\nI promise you. Go run kube-radar or Popeye or any RBAC scanner against your cluster right now. You'll find something embarrassing. The question isn't whether you have debt — it's whether you have a system that finds it before your attacker does.\n\n---\n\n## Why I'm Keeping It\n\nIt's been three weeks since the Friday incident. The Dutch pilot expanded to a second customer. I haven't had a single 3 AM security scare. And when my latest contributor opened a PR with `pods\u002Fexec` in it, the pipeline blocked it before I even saw the notification.\n\nI didn't have to be the bad cop. The code was.\n\nIs automated GitOps security more work to maintain? Yes. I spend maybe an hour per week tuning rules and reviewing override logs.\n\nIs it worth it? Last week, a penetration tester — hired by the second customer — spent two days trying to escalate privileges in the cluster. He found one over-scoped Role. It was in a staging namespace with no production data.\n\nHe wrote in his report: *\"The target environment exhibits unusually robust RBAC hygiene for an early-stage SaaS platform.\"*\n\nThat sentence was worth every minute.\n\n---\n\n## TL;DR — The \"Don't Block Your Own Salary\" Checklist\n\n- [ ] Run an RBAC scanner against your cluster today (kube-radar, Popeye, or rbac-audit)\n- [ ] Add a PreSync security gate to ArgoCD\u002FFlux before your next deploy\n- [ ] Ship new scanner rules on Monday, not Thursday\n- [ ] Build an override mechanism that is **audited**, not **secret**\n- [ ] Change `failurePolicy: Fail` to `Ignore` if you don't have 24\u002F7 webhook SREs\n- [ ] Scan the diff for deploy gates, scan the world for weekly audits\n- [ ] Remember: the pipeline that blocks you is the pipeline that saves you\n\n---\n\n**Want the admission webhook code + ArgoCD PreSync manifests?** [Drop a comment — I'll open-source the gitops-validator repo if there's interest.](#)\n\n**Ever been locked out of your own system by your own automation?** Tell me your war story below. We can start a support group.\n\n*Tags: #kubernetes #security #gitops #devops #go #argocd #rbac #automation #platformengineering*\n\n---\n\n> 🔗 **Nguồn bài viết gốc**: [Le Beltagy](https:\u002F\u002Fdev.to\u002Fle_beltagy\u002Fi-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-227e)\n","I Automated My Entire GitOps Security Stack. The First Thing It Blocked Was My Own Salary. - Intlight Insights","https:\u002F\u002Fintlighttech.com\u002Fblogs\u002Fi-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-pko8",{"items":29,"total":356,"page":357,"totalPages":357,"limit":358,"lang":10,"categories":359,"popularTags":373},[30,49,65,80,93,107,119,132,146,160,174,186,199,211,224,237,251,263,277,290,304,317,329,342,354],{"id":31,"title":32,"slug":33,"lang":10,"category":34,"categorySlug":35,"summary":36,"excerpt":36,"author":37,"date":38,"readTime":39,"image":40,"tags":41,"publishedAt":46,"createdAt":46,"updatedAt":46,"filePath":47,"sourceUrl":48},"cron-1786956218725-en","I Thought I'd Lost the Plot. I Was Writing It.","i-thought-id-lost-the-plot-i-was-writing-it-wjvz","AI Agents","ai-agents","I Thought I'd Lost the Plot. I Was Writing It.            I set out to build autonomous...","Joe Black","8\u002F17\u002F2026","6 min read","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fa3l9h76kr920p8bm2mjp.png",[34,42,43,44,45],"claudecode","aiagents","developmenttools","autonomousagents","2026-08-17T08:43:38.725Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Fi-thought-id-lost-the-plot-i-was-writing-it-wjvz.md","https:\u002F\u002Fdev.to\u002Fjoeblackwaslike\u002Fi-thought-id-lost-the-plot-i-was-writing-it-5fil",{"id":50,"title":51,"slug":52,"lang":10,"category":53,"categorySlug":54,"summary":55,"excerpt":55,"author":56,"date":38,"readTime":39,"image":57,"tags":58,"publishedAt":62,"createdAt":62,"updatedAt":62,"filePath":63,"sourceUrl":64},"cron-1786956216746-en","What Is the Circuit Breaker Pattern? A Practical Guide","what-is-the-circuit-breaker-pattern-a-practical-guide-4j68","Microservices","microservices","What Is the Circuit Breaker Pattern? A Practical Guide for Developers   Imagine your...","Avijit Bera","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fi6cy1uyqxjd14ikkveev.png",[53,54,59,60,61],"backend","api","Trending","2026-08-17T08:43:36.746Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Fwhat-is-the-circuit-breaker-pattern-a-practical-guide-4j68.md","https:\u002F\u002Fdev.to\u002Favijitbera\u002Fwhat-is-the-circuit-breaker-pattern-a-practical-guide-20i4",{"id":66,"title":67,"slug":68,"lang":10,"category":69,"categorySlug":19,"summary":70,"excerpt":70,"author":71,"date":38,"readTime":39,"image":72,"tags":73,"publishedAt":77,"createdAt":77,"updatedAt":77,"filePath":78,"sourceUrl":79},"cron-1786956214008-en","I attacked my own npm package before launching it. It let the proposer approve their own writes","i-attacked-my-own-npm-package-before-launching-it-it-let-the-proposer-approve-their-own-writes-oi6y","Security","My library exists so a human approves an LLM's UPDATE before it runs. It never checked that the approver was somebody other than the proposer — and wrote \\\"approved\\\" into the audit trail anyway.","hyuga","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F65yv5n4qvrgn3t6ot4gy.png",[69,74,75,19,76],"opensource","ai","database","2026-08-17T08:43:34.007Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fi-attacked-my-own-npm-package-before-launching-it-it-let-the-proposer-approve-their-own-writes-oi6y.md","https:\u002F\u002Fdev.to\u002Fhyuga611\u002Fi-attacked-my-own-npm-package-before-launching-it-it-let-the-proposer-approve-their-own-writes-4mki",{"id":81,"title":82,"slug":83,"lang":10,"category":11,"categorySlug":12,"summary":84,"excerpt":84,"author":85,"date":38,"readTime":39,"image":86,"tags":87,"publishedAt":90,"createdAt":90,"updatedAt":90,"filePath":91,"sourceUrl":92},"cron-1786956210950-en","Build an MCP Server in Go (Part 1): Designing a diagnostic-grade Kubernetes client","build-an-mcp-server-in-go-part-1-designing-a-diagnostic-grade-kubernetes-client-p1d4","This post designs the Kubernetes client. The next post wraps it as an MCP server and wires it to an...","Fer Rios","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fpw4b055hh8hxl5unrmvv.png",[11,12,88,21,89],"go","mcp","2026-08-17T08:43:30.949Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fbuild-an-mcp-server-in-go-part-1-designing-a-diagnostic-grade-kubernetes-client-p1d4.md","https:\u002F\u002Fdev.to\u002Fferztyle\u002Fbuild-an-mcp-server-in-go-part-1-designing-a-diagnostic-grade-kubernetes-client-49a2",{"id":94,"title":95,"slug":96,"lang":10,"category":34,"categorySlug":35,"summary":97,"excerpt":97,"author":98,"date":38,"readTime":39,"image":99,"tags":100,"publishedAt":104,"createdAt":104,"updatedAt":104,"filePath":105,"sourceUrl":106},"cron-1786956117904-en","The Write Policy Is the Hard Part: Promotion Pipelines for Agent Memory","the-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-4qv9","Storing agent memory is easy. Deciding what earns a permanent write, and keeping the write-path alive through RBAC and network policy, is the real work.","Guatu","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fguatulabs.dev%2Fog%2Fthe-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory.png",[34,43,101,102,103],"agentmemory","rbac","networkpolicies","2026-08-17T08:41:57.903Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Fthe-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-4qv9.md","https:\u002F\u002Fdev.to\u002Ffuthgar\u002Fthe-write-policy-is-the-hard-part-promotion-pipelines-for-agent-memory-5mc",{"id":108,"title":109,"slug":110,"lang":10,"category":34,"categorySlug":35,"summary":111,"excerpt":111,"author":112,"date":38,"readTime":16,"image":113,"tags":114,"publishedAt":116,"createdAt":116,"updatedAt":116,"filePath":117,"sourceUrl":118},"cron-1786955347611","I Changed How I Think About AI Memory","i-changed-how-i-think-about-ai-memory-fnpm","I Changed How I Think About AI Memory   When I first built Lean AI Memory, I focused too...","Phúc Phùng","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F0oqod5zshdan74573bau.png",[34,75,43,74,115],"git","2026-08-17T08:29:07.610Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Fi-changed-how-i-think-about-ai-memory-fnpm.md","https:\u002F\u002Fdev.to\u002Fphucphungbk\u002Fi-changed-how-i-think-about-ai-memory-4mkd",{"id":120,"title":121,"slug":122,"lang":10,"category":53,"categorySlug":54,"summary":123,"excerpt":123,"author":124,"date":38,"readTime":16,"image":125,"tags":126,"publishedAt":129,"createdAt":129,"updatedAt":129,"filePath":130,"sourceUrl":131},"cron-1786955347443","Real-Life Refactoring Example: ~3x Less Code to Read","real-life-refactoring-example-3x-less-code-to-read-dccm","There is a popular idea that refactoring is making code shorter. It is not entirely wrong....","Valentine Shi","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Foubl9dlj23byhsak2mqy.png",[53,127,128,59,54],"node","software","2026-08-17T08:29:07.443Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Freal-life-refactoring-example-3x-less-code-to-read-dccm.md","https:\u002F\u002Fdev.to\u002Fvalentineshi-dev\u002Freal-life-refactoring-example-3x-less-code-to-read-3mdl",{"id":133,"title":134,"slug":135,"lang":10,"category":69,"categorySlug":19,"summary":136,"excerpt":136,"author":137,"date":38,"readTime":16,"image":138,"tags":139,"publishedAt":143,"createdAt":143,"updatedAt":143,"filePath":144,"sourceUrl":145},"cron-1786955347034","The Tragedy of the Clean-Handed Auditor","the-tragedy-of-the-clean-handed-auditor-rgoz","\\\"I could save them if they'd only listen...\\\"  Hey, you. Yeah, you: the compliance or governance...","Ben Link","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2F5z426h3tt6e2b3sthd2f.png",[69,19,140,141,142],"compliance","developers","careerdevelopment","2026-08-17T08:29:07.034Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fthe-tragedy-of-the-clean-handed-auditor-rgoz.md","https:\u002F\u002Fdev.to\u002Flinkbenjamin\u002Fthe-tragedy-of-the-clean-handed-auditor-1253",{"id":147,"title":148,"slug":149,"lang":10,"category":11,"categorySlug":12,"summary":150,"excerpt":150,"author":151,"date":38,"readTime":16,"image":152,"tags":153,"publishedAt":157,"createdAt":157,"updatedAt":157,"filePath":158,"sourceUrl":159},"cron-1786955346614","Building Sluice: QoS-Aware Capacity Governance for Self-Hosted LLM Inference","building-sluice-qos-aware-capacity-governance-for-self-hosted-llm-inference-flbu","📦 Project: https:\u002F\u002Fgithub.com\u002FVampiricCyborg\u002Fsluice           1. The Problem: When Capacity Becomes...","Madhav M S","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fh3vuie9oakcn3bqzxtbh.png",[11,154,155,12,156],"distributedsystems","llm","systemdesign","2026-08-17T08:29:06.613Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fbuilding-sluice-qos-aware-capacity-governance-for-self-hosted-llm-inference-flbu.md","https:\u002F\u002Fdev.to\u002Fvampiriccyborg\u002Fbuilding-sluice-qos-aware-capacity-governance-for-self-hosted-llm-inference-13ja",{"id":161,"title":162,"slug":163,"lang":10,"category":34,"categorySlug":35,"summary":164,"excerpt":164,"author":165,"date":38,"readTime":16,"image":166,"tags":167,"publishedAt":171,"createdAt":171,"updatedAt":171,"filePath":172,"sourceUrl":173},"cron-1786954879160","Test What Your AI Agents Must Not Do","test-what-your-ai-agents-must-not-do-fj6y","A Guardrail Without A Negative Test Is Still An Assumption   Most AI agent governance starts...","Bobai Kato","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fres.cloudinary.com%2Fota-run%2Fimage%2Fupload%2Fq_auto%2Ftest-what-your-ai-agents-must-not-do.png",[34,43,168,169,170],"agentsafety","negativetesting","executiongovernance","2026-08-17T08:21:19.160Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Ftest-what-your-ai-agents-must-not-do-fj6y.md","https:\u002F\u002Fdev.to\u002Fotaready\u002Ftest-what-your-ai-agents-must-not-do-3e1a",{"id":175,"title":176,"slug":177,"lang":10,"category":53,"categorySlug":54,"summary":178,"excerpt":178,"author":179,"date":38,"readTime":16,"image":180,"tags":181,"publishedAt":183,"createdAt":183,"updatedAt":183,"filePath":184,"sourceUrl":185},"cron-1786954878754","Protecting Microservices: Implementing End-to-End Encryption Across REST APIs","protecting-microservices-implementing-end-to-end-encryption-across-rest-apis-gtfz","End-to-end encryption across REST APIs is the difference between a microservices architecture that...","Fu'ad Husnan","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fba3onadsxu08gb14brer.png",[53,60,54,61,182],"2026","2026-08-17T08:21:18.754Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Fprotecting-microservices-implementing-end-to-end-encryption-across-rest-apis-gtfz.md","https:\u002F\u002Fdev.to\u002Ffuadhusnan_f44f3e13\u002Fprotecting-microservices-implementing-end-to-end-encryption-across-rest-apis-26hb",{"id":187,"title":188,"slug":189,"lang":10,"category":69,"categorySlug":19,"summary":190,"excerpt":190,"author":191,"date":38,"readTime":16,"image":192,"tags":193,"publishedAt":196,"createdAt":196,"updatedAt":196,"filePath":197,"sourceUrl":198},"cron-1786954878272","I Gave My Agent One Signed Permission It Couldn’t Mint Itself","i-gave-my-agent-one-signed-permission-it-couldnt-mint-itself-nm1o","Evidence status. The supervised operator run completed on 2026-08-09. An operator-signed job...","Self-Correcting Systems","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fg1gjbzx4muvma5fznpjl.png",[69,194,21,19,195],"machinelearning","agents","2026-08-17T08:21:18.271Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fi-gave-my-agent-one-signed-permission-it-couldnt-mint-itself-nm1o.md","https:\u002F\u002Fdev.to\u002Fkenielzep97\u002Fi-gave-my-agent-one-signed-permission-it-couldnt-mint-itself-2lpc",{"id":200,"title":201,"slug":202,"lang":10,"category":11,"categorySlug":12,"summary":203,"excerpt":203,"author":204,"date":38,"readTime":16,"image":205,"tags":206,"publishedAt":208,"createdAt":208,"updatedAt":208,"filePath":209,"sourceUrl":210},"cron-1786954877848","One GPU, four ways to share it: ten scenarios, and the headline finding I had to retract","one-gpu-four-ways-to-share-it-ten-scenarios-and-the-headline-finding-i-had-to-retract-3y1v","I measured every GPU sharing mode across ten scenarios, published a headline finding that duplicate models are nearly free on unified memory, then failed to replicate it and retracted it. Here is what the controlled replication showed and how the original measurement fooled me.","Christopher Maher","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fllmkube.com%2Fog-gpu-sharing-four-ways-devto.png",[11,12,207,75,21],"gpu","2026-08-17T08:21:17.847Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fone-gpu-four-ways-to-share-it-ten-scenarios-and-the-headline-finding-i-had-to-retract-3y1v.md","https:\u002F\u002Fdev.to\u002Fdefilan\u002Fone-gpu-four-ways-to-share-it-ten-scenarios-and-the-one-number-that-inverts-on-your-hardware-1bih",{"id":212,"title":213,"slug":214,"lang":10,"category":34,"categorySlug":35,"summary":215,"excerpt":215,"author":98,"date":15,"readTime":16,"image":216,"tags":217,"publishedAt":221,"createdAt":221,"updatedAt":221,"filePath":222,"sourceUrl":223},"cron-1786954563310","FastMCP Agent Mail: RBAC Tokens vs Anonymous Access, and the 403 Errors in Between","fastmcp-agent-mail-rbac-tokens-vs-anonymous-access-and-the-403-errors-in-between-ef0p","Why a FastMCP agent mail server that works anonymously in dev returns 403 behind TLS ingress, and how to wire bearer tokens without leaking them.","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fguatulabs.dev%2Fog%2Ffastmcp-agent-mail-rbac-token-vs-anonymous-lessons-from-403-errors.png",[34,218,219,43,220],"fastmcp","mcpservers","authentication","2026-08-17T08:16:03.310Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Ffastmcp-agent-mail-rbac-tokens-vs-anonymous-access-and-the-403-errors-in-between-ef0p.md","https:\u002F\u002Fdev.to\u002Ffuthgar\u002Ffastmcp-agent-mail-rbac-tokens-vs-anonymous-access-and-the-403-errors-in-between-22pk",{"id":225,"title":226,"slug":227,"lang":10,"category":53,"categorySlug":54,"summary":228,"excerpt":228,"author":229,"date":15,"readTime":16,"image":230,"tags":231,"publishedAt":234,"createdAt":234,"updatedAt":234,"filePath":235,"sourceUrl":236},"cron-1786954562962","eBPF-Powered Request Tracing in Go Microservices Without Instrumentation Tax","ebpf-powered-request-tracing-in-go-microservices-without-instrumentation-tax-k53p","How eBPF uprobes and ring buffers replace manual trace propagation in Go services—mechanics, tradeoffs, and failure modes.","Neeraj Singhi","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fws515jitp8rvalxr8d63.png",[53,232,88,54,233],"architecture","performance","2026-08-17T08:16:02.962Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Febpf-powered-request-tracing-in-go-microservices-without-instrumentation-tax-k53p.md","https:\u002F\u002Fdev.to\u002Fneeraj_singhi_golang\u002Febpf-powered-request-tracing-in-go-microservices-without-instrumentation-tax-34kf",{"id":238,"title":239,"slug":240,"lang":10,"category":69,"categorySlug":19,"summary":241,"excerpt":241,"author":242,"date":15,"readTime":16,"image":243,"tags":244,"publishedAt":248,"createdAt":248,"updatedAt":248,"filePath":249,"sourceUrl":250},"cron-1786954562825","How Dopamine Works: The Architecture of a Modern iOS Jailbreak","how-dopamine-works-the-architecture-of-a-modern-ios-jailbreak-woxq","Most developers will never jailbreak a phone. That is fine. This article is not a how-to, and there...","ArshTechPro","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F0gnfjvl3fzvb1r1rpvci.png",[69,245,246,19,247],"ios","mobile","programming","2026-08-17T08:16:02.825Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fhow-dopamine-works-the-architecture-of-a-modern-ios-jailbreak-woxq.md","https:\u002F\u002Fdev.to\u002Farshtechpro\u002Fhow-dopamine-works-the-architecture-of-a-modern-ios-jailbreak-2hj3",{"id":252,"title":253,"slug":254,"lang":10,"category":11,"categorySlug":12,"summary":255,"excerpt":255,"author":256,"date":15,"readTime":16,"image":257,"tags":258,"publishedAt":260,"createdAt":260,"updatedAt":260,"filePath":261,"sourceUrl":262},"cron-1786954562468","I got tired of SSHing into 10 VMs a day, so I built a live map of my whole infrastructure","i-got-tired-of-sshing-into-10-vms-a-day-so-i-built-a-live-map-of-my-whole-infrastructure-iqz9","Every day at work looked the same. Something breaks, or I need to push a new image, and I'm SSHing...","ByteStrix","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F4xdxpc7fsu7nv8usri7a.png",[11,259,21,74,12],"productivity","2026-08-17T08:16:02.468Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fi-got-tired-of-sshing-into-10-vms-a-day-so-i-built-a-live-map-of-my-whole-infrastructure-iqz9.md","https:\u002F\u002Fdev.to\u002Fbytestrix\u002Fi-got-tired-of-sshing-into-10-vms-a-day-so-i-built-a-live-map-of-my-whole-infrastructure-2iil",{"id":264,"title":265,"slug":266,"lang":10,"category":34,"categorySlug":35,"summary":267,"excerpt":267,"author":268,"date":15,"readTime":16,"image":269,"tags":270,"publishedAt":274,"createdAt":274,"updatedAt":274,"filePath":275,"sourceUrl":276},"cron-1786954558132","The Coordinated Rename Is the Agent's Most Dangerous Refactor","the-coordinated-rename-is-the-agents-most-dangerous-refactor-iazu","Multi-agent rename tooling rewrites two hundred files in ten seconds because it noticed the drift. Half the time the drift was a load-bearing distinction the team encoded on purpose. Vocabulary curation is a real-time review surface now, and senior includes refusing changes that would be technically more consistent because the domain has two concepts the agent has no way to see.","Travis Frisinger","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fwww.tddbuddy.com%2Fimages%2Fcovers%2Fthe-coordinated-rename-is-the-dangerous-refactor.png",[34,271,43,272,273],"vocabulary","domainmodeling","codereview","2026-08-17T08:15:58.132Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Fthe-coordinated-rename-is-the-agents-most-dangerous-refactor-iazu.md","https:\u002F\u002Fdev.to\u002Ftmfrisinger\u002Fthe-coordinated-rename-is-the-agents-most-dangerous-refactor-6a",{"id":278,"title":279,"slug":280,"lang":10,"category":53,"categorySlug":54,"summary":281,"excerpt":281,"author":282,"date":15,"readTime":16,"image":283,"tags":284,"publishedAt":287,"createdAt":287,"updatedAt":287,"filePath":288,"sourceUrl":289},"cron-1786954557526","Microservices: Building Applications as Independent, Communicating Services","microservices-building-applications-as-independent-communicating-services-c45k","Microservices: Building Applications as Independent, Communicating Services   A practical,...","Rhuturaj Takle","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F8puio1c7flrtyivr04hl.png",[53,54,285,247,286],"dotnet","learning","2026-08-17T08:15:57.526Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Fmicroservices-building-applications-as-independent-communicating-services-c45k.md","https:\u002F\u002Fdev.to\u002Frhuturaj_takle\u002Fmicroservices-building-applications-as-independent-communicating-services-2eo8",{"id":291,"title":292,"slug":293,"lang":10,"category":69,"categorySlug":19,"summary":294,"excerpt":294,"author":295,"date":15,"readTime":16,"image":296,"tags":297,"publishedAt":301,"createdAt":301,"updatedAt":301,"filePath":302,"sourceUrl":303},"cron-1786954556056","From Arduino To Automotive: How I Escaped The IDE And Owned The Bus","from-arduino-to-automotive-how-i-escaped-the-ide-and-owned-the-bus-hj7g","Arduino taught me how to build. Bare metal taught me how the build actually works.  I have a lot of...","v. Splicer","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fabn3138rnp9vm0nyk54b.jpg",[69,298,299,300,19],"esp32","arduino","canbus","2026-08-17T08:15:56.056Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Ffrom-arduino-to-automotive-how-i-escaped-the-ide-and-owned-the-bus-hj7g.md","https:\u002F\u002Fdev.to\u002Fnumbpill3d\u002Ffrom-arduino-to-automotive-how-i-escaped-the-ide-and-owned-the-bus-f8f",{"id":305,"title":306,"slug":307,"lang":10,"category":11,"categorySlug":12,"summary":308,"excerpt":308,"author":309,"date":15,"readTime":16,"image":310,"tags":311,"publishedAt":314,"createdAt":314,"updatedAt":314,"filePath":315,"sourceUrl":316},"cron-1786954555663","The Backup Awakens: A Star Wars Story","the-backup-awakens-a-star-wars-story-jzpq","The Quest Begins (The \\\"Why\\\")   Honestly, I used to think backups were the boring chores you...","Timevolt","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F4ynsfxiz14nn4b9ylhn6.png",[11,21,312,12,313],"docker","cicd","2026-08-17T08:15:55.662Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fkubernetes\u002Fthe-backup-awakens-a-star-wars-story-jzpq.md","https:\u002F\u002Fdev.to\u002Ftimevolt\u002Fthe-backup-awakens-a-star-wars-story-1616",{"id":318,"title":319,"slug":320,"lang":10,"category":34,"categorySlug":35,"summary":321,"excerpt":321,"author":268,"date":15,"readTime":16,"image":322,"tags":323,"publishedAt":326,"createdAt":326,"updatedAt":326,"filePath":327,"sourceUrl":328},"cron-1786954321408","Test Deletion Is a Privileged Operation","test-deletion-is-a-privileged-operation-2pfz","The cheapest way for an agent to make a failing test pass is to delete it. That is logical for the agent and catastrophic for the codebase. Tests are append-only by default. Deletion needs a human author, a separate commit, and a separate review.","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fwww.tddbuddy.com%2Fimages%2Fcovers%2Ftest-deletion-is-a-privileged-operation.png",[34,324,43,325,273],"tdd","testdesign","2026-08-17T08:12:01.408Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fai-agents\u002Ftest-deletion-is-a-privileged-operation-2pfz.md","https:\u002F\u002Fdev.to\u002Ftmfrisinger\u002Ftest-deletion-is-a-privileged-operation-264a",{"id":330,"title":331,"slug":332,"lang":10,"category":53,"categorySlug":54,"summary":333,"excerpt":333,"author":334,"date":15,"readTime":16,"image":335,"tags":336,"publishedAt":339,"createdAt":339,"updatedAt":339,"filePath":340,"sourceUrl":341},"cron-1786954321239","You Don't Always Need a Workflow Engine to Roll Back a Failed Checkout","you-dont-always-need-a-workflow-engine-to-roll-back-a-failed-checkout-1iwf","Here's a sequence that shows up in almost every Laravel app that talks to the outside world:   Charge...","Sient","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fu6g3j4z4af9tbuozbz2v.png",[53,337,338,232,54],"laravel","php","2026-08-17T08:12:01.239Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fmicroservices\u002Fyou-dont-always-need-a-workflow-engine-to-roll-back-a-failed-checkout-1iwf.md","https:\u002F\u002Fdev.to\u002Fsient\u002Fyou-dont-always-need-a-workflow-engine-to-roll-back-a-failed-checkout-5gop",{"id":343,"title":344,"slug":345,"lang":10,"category":69,"categorySlug":19,"summary":346,"excerpt":346,"author":347,"date":15,"readTime":16,"image":348,"tags":349,"publishedAt":351,"createdAt":351,"updatedAt":351,"filePath":352,"sourceUrl":353},"cron-1786954321092","I Stopped Trusting AI Agents With Tools. So I Built a Gatekeeper.","i-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-9i2m","Update 08\u002F15 0.2.0 Released   github.com\u002Fdeghosal-2026\u002Fagent-tooltrust · pip install agent-tooltrust...","Debashish Ghosal","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1000,height=420,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fr97gsrqar0qk7ejjibih.png",[69,75,195,19,350],"gatekeeper","2026-08-17T08:12:01.092Z","\u002FUsers\u002Fnguyenanhtuan\u002FCode\u002FNuxtjs\u002Fnextpress\u002Fintlight\u002Fpublic\u002Fcontents\u002Fsecurity\u002Fi-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-9i2m.md","https:\u002F\u002Fdev.to\u002Fdebashish_ghosal\u002Fi-stopped-trusting-ai-agents-with-tools-so-i-built-a-gatekeeper-26fb",{"id":7,"title":8,"slug":9,"lang":10,"category":11,"categorySlug":12,"summary":13,"excerpt":13,"author":14,"date":15,"readTime":16,"image":17,"tags":355,"publishedAt":22,"createdAt":22,"updatedAt":22,"filePath":23,"sourceUrl":24},[11,12,19,20,21],25,1,50,[360,363,367,369,370,371],{"name":361,"slug":362,"count":356},"All","all",{"name":364,"slug":365,"count":366},"Nuxt 4","nuxt-4",0,{"name":11,"slug":12,"count":368},6,{"name":69,"slug":19,"count":368},{"name":53,"slug":54,"count":368},{"name":34,"slug":35,"count":372},7,[374,375,376,377,378,379,380,381,382,383,385,387,389,390,392],{"name":34,"slug":35,"count":372},{"name":43,"slug":43,"count":372},{"name":19,"slug":19,"count":372},{"name":53,"slug":54,"count":368},{"name":54,"slug":54,"count":368},{"name":69,"slug":19,"count":368},{"name":11,"slug":12,"count":368},{"name":12,"slug":12,"count":368},{"name":21,"slug":21,"count":368},{"name":75,"slug":75,"count":384},4,{"name":74,"slug":74,"count":386},3,{"name":59,"slug":59,"count":388},2,{"name":60,"slug":60,"count":388},{"name":61,"slug":391,"count":388},"trending",{"name":88,"slug":88,"count":388},{"success":394,"slug":9,"lang":10,"items":395,"total":456,"page":357,"limit":457,"hasMore":394,"remaining":372},true,[396,407,426,436,446],{"author":397,"avatar":398,"role":399,"date":400,"createdAt":401,"content":402,"likes":403,"isLiked":404,"replies":405,"id":406},"Kenji Sato","K","Principal Infrastructure Architect","2 days ago","2026-08-15T10:09:00.577Z","Intlight's multi-region architectural blueprints set the benchmark for ultra-resilient, enterprise-grade cloud systems in 2026.",53,false,[],"c-i-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-pko8-en-1",{"author":408,"avatar":409,"role":410,"date":411,"createdAt":412,"content":413,"likes":414,"isLiked":404,"replies":415,"id":425},"Marcus Vance","M","Head of AI Engineering @ NextWave","1 hour ago","2026-08-17T09:09:00.576Z","The Agent Memory Pipeline section hits the nail on the head. Hierarchical memory indexing with Qdrant vector search is the only sustainable way to scale long-context autonomous agents.",42,[416],{"author":417,"avatar":418,"role":419,"date":420,"createdAt":421,"content":422,"likes":423,"isLiked":404,"id":424},"Sarah Jenkins","S","LLM Research Scientist","30 mins ago","2026-08-17T09:39:00.576Z","Yes! Separating episodic memory from working context allows agents to operate indefinitely without token explosion.",19,"r-i-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-pko8-en-2-1","c-i-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-pko8-en-2",{"author":427,"avatar":428,"role":429,"date":430,"createdAt":431,"content":432,"likes":433,"isLiked":404,"replies":434,"id":435},"Priya Sharma","P","Distributed Database Architect","5 hours ago","2026-08-17T05:09:00.577Z","The latency comparisons between gRPC Protobuf binary encoding and standard JSON payloads demonstrate exactly why internal services should deprecate REST for high-throughput pipelines.",38,[],"c-i-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-pko8-en-3",{"author":437,"avatar":438,"role":439,"date":440,"createdAt":441,"content":442,"likes":443,"isLiked":404,"replies":444,"id":445},"Hannah Schmidt","H","DevOps & CI\u002FCD Lead","1 day ago","2026-08-16T10:09:00.577Z","Can confirm: automated canary deployments with Argo Rollouts and Prometheus metrics analysis prevented several outages for our payment gateways.",31,[],"c-i-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-pko8-en-4",{"author":447,"avatar":448,"role":449,"date":450,"createdAt":451,"content":452,"likes":453,"isLiked":404,"replies":454,"id":455},"Elena Rostova","E","Lead SRE & Platform Architect","45 mins ago","2026-08-17T09:24:00.576Z","The KEDA autoscaling setup with custom Prometheus metrics is production-grade. We observed a 60% compute cost reduction after switching to event-driven pod scaling.",34,[],"c-i-automated-my-entire-gitops-security-stack-the-first-thing-it-blocked-was-my-own-salary-pko8-en-5",15,5,1786961341906]