/tags/security/Recent content in Security on Momo Engineering Journal/images/og-image.png/images/og-image.pngHugoen-usWed, 21 Oct 2026 11:26:56 -0600/posts/057-bolt-sigv4-zero-alloc-headers/Thu, 15 Oct 2026 11:43:50 +0000/posts/057-bolt-sigv4-zero-alloc-headers/Every authenticated S3 request rebuilds a SigV4 canonical-headers block — and the two obvious ways to write it (strings.Split and Header.Get) each allocate on the hottest authorization path. This post walks through replacing both with an IndexByte scan and an EqualFold lookup, and the golden-equivalence test that proves the rewrite is byte-identical for every request AWS clients actually send./posts/044-plugin-seam-architecture/Wed, 26 Aug 2026 16:45:18 +0000/posts/044-plugin-seam-architecture/Adaptive behaviors use compile-time Go interface seams injected at decision points — not dynamic plugins. The fast path stays concrete; the trust core stays auditable; policy is declarative./posts/054-secrets-management-key-rotation/Tue, 25 Aug 2026 03:25:35 +0000/posts/054-secrets-management-key-rotation/How momo manages encryption keys without a central secret server: a pluggable provider chain (env, then config file), a per-node versioned key registry in local storage, and rotation that promotes a new key without any downtime. Teaches: why a provider chain beats a single source, how key versioning enables online rotation, and when rotation is and is not worth the complexity./posts/053-multitenancy-authorization-audit/Tue, 25 Aug 2026 03:25:29 +0000/posts/053-multitenancy-authorization-audit/How momo isolates tenants without a central secret server: HKDF-derived per-tenant keys, default-deny ACLs evaluated per request, and a SHA-256 hash-chained audit log that makes tampering detectable. Teaches: key derivation vs. key storage, why ACL evaluation order matters, and how hash chaining turns a log into evidence./posts/015-sentinel-security-audit/Tue, 04 Aug 2026 00:47:24 +0000/posts/015-sentinel-security-audit/A 76-deep audit (authed via Sentinel) surfaced CRLF injection, smuggling, traversal and path leaks — the pattern that forged momo’s security mindset./posts/037-zero-crash-hardening-patterns/Wed, 03 Jun 2026 06:03:39 +0000/posts/037-zero-crash-hardening-patterns/Systematic defensive coding: nil-safety, numeric overflow guards, resource lifecycle discipline, panic recovery at every boundary, and concurrency safety under -race.