Working methods
2 entrys
Release discipline, workflow design, and habits that keep technical work understandable over time.
Writing
An editorial desk for technical arguments, working notes, and field judgment.
Vandor Writing is where the organization slows down enough to explain what it thinks a technical event means, which practices hold up under pressure, and what is worth learning from real systems.
Editorial desk
Curated in lanes, not exposed as a feed of filters and controls.
Current archive
6 published pieces
Reading lanes
3 active lanes
Latest entry
May 19, 2026
Vandor
May 18, 2026
Security desk
Long-Lived npm Publish Tokens Should Be Treated as Migration Debt
npm's current guidance is clear: package publishing from CI should move toward trusted publishing with OIDC, not stay anchored to long-lived secrets.
Lead document
security / npm / supply-chain
Read essay
Across the desk
The archive is grouped by the kind of thinking it carries, so breadth reads as editorial intent rather than content inventory.
Security desk
2 entrys
Technical incidents and vulnerabilities read as operator decisions, not just advisories.
Arguments
1 essay
Pieces that explain how Vandor thinks about systems, maintainership, and the shape of technical work.
Recently added
Reading lanes
The archive is arranged by how Vandor thinks, not only by when something was published.
Security notes, working practices, essays, and field observations should feel like related strands of thought, not one endless stream of interchangeable posts.
Working methods
Practices and operational routines
Release discipline, workflow design, and habits that keep technical work understandable over time.
Vandor
May 17, 2026
GitHub Actions Security Is Moving From Secrets to Policy
GitHub's 2026 Actions roadmap suggests a deeper shift in CI/CD security: away from secret-centric thinking and toward policy, defaults, and observability.
Security desk
Boundary failures, risk, and response
Technical incidents and vulnerabilities read as operator decisions, not just advisories.
May 19, 2026
Vandor
Copy Fail Is Not Just a Local Linux Bug
CVE-2026-31431 matters because in modern fleets, local privilege escalation is often an infrastructure problem rather than a single-host problem.
May 16, 2026
Vandor
CrackArmor Is a Boundary Problem, Not Just an AppArmor Bug
The CrackArmor vulnerability set should be read as a failure of containment boundaries on shared Linux hosts, not merely as another local kernel issue.
Arguments
Longer essays and institutional points of view
Pieces that explain how Vandor thinks about systems, maintainership, and the shape of technical work.
Desk archive
A quieter chronological trail remains below.
Writing keeps the arguments. News keeps the release trail. The archive below stays text-led so it can work as a compact reading index as the publication grows.
Read Vandor newsMay 19, 2026
Copy Fail Is Not Just a Local Linux Bug
CVE-2026-31431 matters because in modern fleets, local privilege escalation is often an infrastructure problem rather than a single-host problem.
Security desk
May 18, 2026
Long-Lived npm Publish Tokens Should Be Treated as Migration Debt
npm's current guidance is clear: package publishing from CI should move toward trusted publishing with OIDC, not stay anchored to long-lived secrets.
Security desk
May 17, 2026
GitHub Actions Security Is Moving From Secrets to Policy
GitHub's 2026 Actions roadmap suggests a deeper shift in CI/CD security: away from secret-centric thinking and toward policy, defaults, and observability.
Working methods
May 16, 2026
CrackArmor Is a Boundary Problem, Not Just an AppArmor Bug
The CrackArmor vulnerability set should be read as a failure of containment boundaries on shared Linux hosts, not merely as another local kernel issue.
Security desk
May 15, 2026
Kubernetes Policy That Lives Only in the API Is Not a Strong Enough Boundary
Kubernetes v1.36's manifest-based admission control matters because it recognizes a hard truth: API-level policy is weaker when the API can remove it.
Working methods
May 14, 2026
Open Source Needs More Friction Than It Used To
In an era of AI-assisted contribution volume, some contribution friction is no longer a failure of openness. It is a maintainership tool.
Arguments