/sbin
The privileged operations, and the boundaries around them. Holding production access at more than one company changes what the threat model is: the realistic failure is not someone breaking in, it is me making an ordinary mistake with real credentials in the shell. Almost everything here is arranged so that the mistake either cannot happen or fails loudly.
Keys never touch the disk
Every SSH key lives in the password manager's agent. Nothing unencrypted exists in the ssh directory, which means there is no file to accidentally copy into a backup, a screen share, or a repository.
Commit signing uses the same key over SSH rather than a separate GPG keyring — one key to hold, no expiry to forget, and platforms verify it identically. Git is configured to reference the public key rather than a path to a private one, so nothing in the configuration depends on a private key existing on disk.
Platform authentication goes through the vendor CLI as the credential helper. No personal access token sits in a file, and revoking access is a single logout rather than a hunt through config.
Secret scanning is a property of the machine
Git is configured with a template directory, so every clone and every init copies the hook set into the new repository automatically. Secret scanning is therefore not something to remember per repository — it is already there before the first commit.
The distinction matters more than it first appears. A repository cloned in a hurry, under time pressure, is precisely the one where a key ends up pasted into a commit. Running a setup command per repository is a policy, and policies get skipped. This is a guarantee.
The one gap worth naming: it applies at clone time, so repositories that predate the setting need the hooks installed once, or a fresh clone.
Two levels of cloud access
Read access is ambient and write access is deliberate, and they are reached by different commands on purpose.
- Ambient
- Per-directory environment binds a read-only account context automatically on entering a repository. It is scoped to that directory, and it is not a decision — it is just the correct default for wherever I happen to be.
- Deliberate
- Stepping up to a privileged role is an explicit command that performs the sign-in and exports temporary credentials into that shell alone. Closing the tab ends the access. Nothing is written to a credentials file.
The step up also opens the cloud console in a browser container pinned to that one account. That closes the gap the terminal cannot reach: being signed into the wrong company's console in a tab I forgot about. Isolation in the shell and isolation in the browser have to match, or the weaker one is the real boundary.
Cluster access follows the same shape — one configuration file per cluster, merged at shell startup. Adding an engagement is dropping a file in; ending one is deleting it. There is no monolithic file to hand-edit and get subtly wrong.
Secrets at rest
- sops + age
- Encrypted configuration committed to a repository, with separate keys per engagement. Encrypted-in-git beats a shared document, and per-engagement keys mean one compromise is not all of them.
- cosign
- Signing and verifying container images and artefacts, so what deploys is provably what was built.
- mkcert
- Local TLS the browser trusts, so development runs over HTTPS and nobody learns to click through a certificate warning.
Nothing credential-shaped is exported in a shell profile. Where a secret is genuinely needed at runtime, it is fetched from the password manager at the moment of use rather than persisted into the environment.
Before anything leaves
One command runs secret scanning and a vulnerability, secret, and misconfiguration scan across the working tree. It is the pre-flight before a repository is made public or handed back at the end of an engagement.
It exists as a single word deliberately. A check that takes three commands to run is a check that gets skipped at exactly the moment it matters — the handback, when the work is done and attention has already moved on.
The command itself is in /bin; the identity and branch guardrails it complements are in /etc.
Agent permissions are split in two
AI coding tools need a permission model, and it has two halves that should not live in the same place. The safety controls — the branch guard, the git hooks, the rules about what requires confirmation — are portable, versioned, and public. They are the same on every machine and there is nothing sensitive about them, so they are shared and reviewable.
The permission allow-list is the other half, and it stays private and machine-local. It is specific to one person's habits on one machine, and publishing it would do two unhelpful things at once: advertise exactly which commands run without a prompt, and invite someone to copy a set of grants that was never meant to be a template.
The installer applies the private overlay first, then the portable layer adds its controls on top without taking ownership of personal permissions. Keeping the two separable is what lets the safety half be public at all.
Quieter by default
Analytics and telemetry are disabled across the package manager, the container tooling, and the framework CLIs. Not because any one of them is alarming, but because a machine that touches several companies' codebases should not be reporting on that work by default — and the aggregate of "harmless individually" is not harmless.
Git verifies object integrity on the way in, on both fetch and receive. Cheap, and it turns a class of malformed-object attack into an error rather than a surprise.