Nyxora Labs — Notes https://nyxoralabs.com/notes Engineering notes from Nyxora Labs — thinking on building software that survives its second year. en Thu, 06 Aug 2026 00:00:00 GMT The guard was correct. Its scope was wrong. https://nyxoralabs.com/notes/the-guard-was-correct https://nyxoralabs.com/notes/the-guard-was-correct Thu, 06 Aug 2026 00:00:00 GMT Scan makes requests to whatever host you point it at, so it has a guard against reaching internal addresses. The guard was right. It just wasn’t covering the whole path. A certificate check that worked on my machine and was dead in production https://nyxoralabs.com/notes/dead-in-production https://nyxoralabs.com/notes/dead-in-production Thu, 30 Jul 2026 00:00:00 GMT Scan flags certificates signed with SHA-1. The check ran perfectly in development and silently never fired on the deployed site, because the two run different versions of Node. My scanner told me to add a DNS record that wouldn’t have helped https://nyxoralabs.com/notes/dns-record-that-wouldnt-have-helped https://nyxoralabs.com/notes/dns-record-that-wouldnt-have-helped Thu, 23 Jul 2026 00:00:00 GMT Sentinel checked a subdomain for a DMARC record, didn’t find one, and told me exactly what to add. Following that advice would have accomplished nothing. The scanner said my own site was an F https://nyxoralabs.com/notes/scanner-said-my-own-site-was-an-f https://nyxoralabs.com/notes/scanner-said-my-own-site-was-an-f Thu, 16 Jul 2026 00:00:00 GMT Sentinel graded nyxoralabs.com an F. I’d already hardened it, so only one of us was wrong.