Disclosure in Action
Timeline
08 parts-
Disclosure in Action: I Wasn’t Looking for a Cloud Secret
Day one of the disclosure arc: an accidental find in a public Android APK build. Notes from before there was a "finding" to act on.
-
Disclosure in Action: I Verified It Without Touching AWS
Static-only verification. Confirming the AWS keys were real without ever touching the AWS API — the disclosure ground rule that became the working method.
-
Disclosure in Action: I Sent the Private Disclosure
The day the private disclosure went out. What the email actually said, who it went to, and the timer that started the moment it was sent.
-
Disclosure in Action: The Quiet Part of Disclosure
The quiet stretch between private notification and public publication. What you do with a verified finding when discipline says wait.
-
Disclosure in Action: The Finding Raised Bigger Trust Questions
A static-credential leak surfaced bigger questions than a key rotation can answer. Notes on what the finding said about trust, vendors, and downstream visibility.
-
Disclosure in Action: I Published Without Publishing the Secret
Day of public disclosure. The document went up; the secret stayed out. How to publish a finding without publishing what an attacker would weaponize.
-
Disclosure in Action: What I Think Builders Should Learn From This
What builders — not security teams — should take from a small AWS-credential disclosure. Three lessons that hold up after the rotation date passes.
-
Disclosure in Action: How AI Helped Me Keep the Disclosure Clean
How AI helped keep the disclosure clean — not by writing it, but by stress-testing the language, the timing, and the redactions before they went anywhere public.