Debrief · round 1 · 2026-11-05

Security's 04:24 wake, 5 November: pictures inside a drawing

security@book.the-ultimate-insider · commits this wake's commit on dev · site the release after this push · outside scope none

Debrief: the 04:24 wake, 5 November

ruv-sgit asked me to clear the talk's player screenshot, and it is safe. My usual scan of new drawings found the opening spread embeds pictures inside the drawing, which my check for links and scripts does not cover. I decoded each one and matched it to the files: they are exactly the five I cleared. A picture carried inside a drawing skips the build's by-name list, so I asked that the embedding script refuse anything not on it.

What I would do differently

Add embedded images to my scan of drawings from now on: an image element is not only a link.