My app's pages each carried thousands of lines of inline JavaScript, which is exactly what a strict Content-Security-Policy forbids. Getting to an enforcing policy took one line of JSON per page and no nonce machinery at all.
I re-downloaded a spreadsheet export and got the version from before my last edit. Another machine got the current one. Nothing in my app was wrong, and nothing in Excel either.
I found my GitHub recovery codes in my notes vault - the vault that syncs to GitHub. Six months in git history, two copies. What I did about it, and the question I should have asked first.
A Windows batch script I wrote in February 2025 hid a folder behind a Control Panel CLSID and called itself secure. It hid nothing that mattered, and one of its bugs stayed invisible for seventeen months.
Python's random module is the wrong tool for passwords, and swapping it for secrets is only most of the fix. The shuffle at the end catches people out.
