Vatsalya Goel - Security and software engineering notes

Building a Local OIDC Issuer for Secure Webhook Testing

Building a Local OIDC Issuer for Secure Webhook Testing

Cloud webhook integrations are hard to debug locally because they usually need a public HTTPS endpoint, a validation handshake, and signed bearer tokens. This guide builds a local test harness with Node.js, Express, jose, and ngrok so you can practise the moving parts safely. This is a local demo.

Image of an Azure-style Key vault with one empty glowing slot causing surrounding locks to fail

The Empty Secret That Broke Every Azure Function Key Vault Reference

A debugging note on Azure Function App Key Vault references failing with OtherReasons because one referenced secret had an empty value created through infrastructure as code.

Content Security Policy, properly

Content Security Policy, properly

A practical guide to strict Content Security Policy: nonces, hashes, strict-dynamic, Trusted Types, reporting, and the deployment path that avoids breaking production.

Rewriting Git history : Being opinionated about Git

software-engineering

Rewriting Git history : Being opinionated about Git

An opinionated guide to Git history hygiene, trunk-based development, and making source control easier for the next person who has to understand the repository.

Setting up a public web server using a Raspberry Pi 3

Setting up a public web server using a Raspberry Pi 3

An archival 2017 note on exposing a Raspberry Pi 3 as a public web server and working around home-network limitations with tunneling.