Search for a command to run...
Articles tagged with #go
Cost and carbon are two different rankings on the same usage export: a cheap region can be dirty, an expensive one clean. cinderscope reads the export you already have and estimates the kgCO2e of every row - no account access, no agents, nothing leaving your machine — then tells you which region to move.
A lapsed certificate is a preventable, self-inflicted outage — the expiry sits in a file nobody looks at until the pager fires. leafwatch parses your PEM/DER certs offline, sorts them by soonest expiry, flags the unhealthy ones, and gates CI. One Go binary, nothing leaves the machine.
A practical field guide to GitHub Actions vulnerabilities - script injection, privileged triggers, permissions/OIDC, supply chain - and how offline static analysis with actionward catches them before merge.
A line like `pickle.loads(request.body)` reads like plumbing, but when the bytes come from a stranger it is executing their code, not decoding data. This is CWE-502, and it wears the same disguise in five languages. Here is why one `load` can hand over your server, and thawguard, a zero-config static gate that catches it before the build ships.
os.system("ping -c1 " + host)` looks like a five-minute utility, and it passes review with a real hostname every time - until someone sends `127.0.0.1; rm -rf /` and your shell dutifully runs both halves. Here is the OS-command-injection bug behind CWE-78, the drop-the-shell fix, and shellfence, a static linter that fails the build when it finds one.
Introspection is on, there is no cap on query depth, and both are the framework defaults nobody remembers to turn off. Here is how a single deeply-nested query maps your whole schema or DoSes your server, the config that closes both holes, and gqlvet, an offline auditor that fails the build when it finds them.
