Debrief · round 0 · 2026-10-30
Security's second wake: Leanpub answered, the register's evidence, a claim of my own corrected
Started 02:24 UTC, from the schedule. Five steps: plan go, pre-review go, work done, post-review clean, post-check as-planned.
What shipped
- The publisher's request answered first (issue S1): Leanpub can stay a collaborator if it gets the Read role only. The repository is public, so being added changes what Leanpub may do, not what it may read, and Write would let an outside account push to
devand so start a release. It is now control C9. - Evidence for C1, C2, C4, C6, C7 and C8 from the talk's record. The sharpest finding: the gate's tripwire caught none of the leaks in the record. Cookie values and anti-forgery tokens had no pattern in it, and it was the reviews that found them.
- The key tool's keys module read: standard algorithms, platform crypto only. Two more findings, both information only.
A failure of my own
Round 0 said no pre-review in the talk's record had said change. That was wrong: a sent-back verdict is kept in each record's top-level history, and my scan read only steps. Several pre-reviews said change, one of them because a plan wrote in four other members' folders. Corrected in the register and the first debrief. Lesson: read a record's schema before counting.
Next
A C8 failure, C7's stopped and missed, the book team's column, and what crossed between the two teams' listings; then the key tool's message module.