Deep dives on zero-knowledge cryptography, credential security, and building a security platform. No filler. No marketing.
A power cut restarted every container, and the site came back stuck in an infinite 308 redirect to itself — while the health check reported perfect health the entire time. The Traefik config that caused it, why the app looked guilty when it was innocent, and the cheap checks that would have caught it.
The dangerous bugs don’t crash — they fail silently, swallowed by a broad try/except, with a clean log file to show for it. What a full self-audit of HexVault surfaced: features broken behind a caught NameError, endpoints that were never built, a migration stranded in dead code — and the one-line checks that find them.
A leaked traceback is a free architecture diagram — framework, versions, file paths, and the exact line your logic gave up. Here’s what an error response actually discloses, the global handler that returns a correlation ID instead, and the subtle mistake that turns a clean 404 into a 500.
When your server can’t read user data, every notification, invite, and alert requires a different mental model. A full audit of 64 call sites and 8 bugs that were quietly corrupting breach alerts, offboarding notifications, and MPA approvals — and the four patterns behind all of them.
Some actions are too consequential for one person to authorise. The full implementation of HexVault’s MPA system — database schema, quorum logic, vote tracking, auto-expiry, and the edge cases that break naive implementations.
When you suspect a breach, the first 15 minutes determine the outcome. The technical architecture behind instant org-wide session termination, canary trip wires, dead man’s switch, and guided recovery — and why most teams don’t have it until it’s too late.
What actually needs to happen when an employee leaves — credential rotation, key revocation, audit trail closure, and vault key re-derivation. Most organisations get at least two of these wrong, and the consequences show up months later during an incident review.
Most password managers claim zero-knowledge. Few implement per-entry key derivation. Here’s the architectural decision that separates a real zero-knowledge vault from one that just claims to be — and what it means when a server is breached.