Most teams never check the license of every package they depend on, including the indirect ones pulled in underneath. That is a real risk. Some licenses, like GPL or AGPL, can legally require you to open-source your own product if you use them a certain way. I built Open License Auditor to catch this automatically. It is a GitHub Action that maps every dependency in your repo, direct and indirect,... [read more]

Dependency updates are one of those things teams keep postponing. Not because they do not care, but because every update feels like a risk. A small version bump can break a build, fail tests, or create unexpected issues in production. That is why I built Update Dependencies , a GitHub Action that keeps dependencies up to date automatically and opens a pull request, gated on your checks passing whe... [read more]

Envelope encryption in AWS Key Management Service (KMS) enhances data security and efficiency by encrypting plaintext data with a data key, which is then encrypted with another key, often a root key. This method ensures robust protection by securing the data keys and allows for efficient re-encryption of keys rather than large datasets. Benefits of Envelope Encryption Enhanced Security: Encrypted ... [read more]

Imagine in a project you are using Amazon API Gateway to define REST APIs. You, as a developer want to allow only IAM users from another AWS account to access the APIs. What would you do? 1. Create an IAM Permission Policy Create an IAM policy in the other AWS account (the account where the IAM users are located) that grants the necessary permissions to invoke the API Gateway methods. The policy s... [read more]