Topic
A security patch triggers a global outage. A configuration change meant to harden infrastructure accidentally breaks it. These case studies cover what happens when the fix is as dangerous as the vulnerability — and how engineering teams navigate security decisions that affect millions of users without a safety net.
A well-reviewed security patch hit production traffic patterns it had never seen in testing, and a retry amplification loop did the rest.
A telemetry pipeline went silent. GitHub's security automation treated the silence as a threat signal — and locked every Codespaces VM out of its own metadata service.
150,000 secrets. 25 separate vaults. Hundreds of teams managing their own credentials in their own ways, some in plain text in version control. At Uber's scale — 5,000 microservices, 5,000 databases, 500,000 analytical jobs per day — secrets sprawl is not a compliance problem. It is an incident waiting to happen. A team of ten engineers decided to fix it.