This is the short record I published at the end of Q2. I am keeping the distinction between what I reported as shipped and what was still in progress on June 30, 2026.
01 / FIELD NOTESShipped, as recorded in the June log
CI deployment authentication moved from long-lived cloud keys to OIDC. The original entry described all CI deploys in that work. The scope still needs the corresponding repository and workflow evidence; it should not be read as a verified statement about every current project.
Gitleaks and Trivy hooks were added across three repositories. The log reported two stale test API keys found in a fixture file. Those counts are part of the historical account, not findings from the portfolio rewrite. No keys are reproduced here.
The Atlas image was reported at roughly 180 MB, down from roughly 1.1 GB. That is the original account's size comparison. It is not a new build result, a speed benchmark, or evidence of a current vulnerability count.
The internal dashboard authentication changed. The log described replacing a homegrown session store with OIDC. That short entry does not establish that sessions stopped existing; the actual authentication/session boundary needs the implementation.
Keep the date attached to the claim.
These are entries in the original account, not new findings or a current release dashboard.
CI → cloud OIDC
All CI deploys, as stated in the June account.
Evidence to check
Workflow files, trust conditions and exact repository scope.
Scanning hooks
Three repositories and two fixture keys, as reported.
Evidence to check
Hook configuration, dated logs and remediation evidence.
Container image
~1.1 GB → ~180 MB, reported in June.
Evidence to check
Image digests, platform, build output and scan date.
Dashboard authentication
A change described as replacing a session store with OIDC.
Evidence to check
The actual identity flow and remaining session handling.
Passkey / WebAuthn
Still listed as in progress on June 30.
Evidence to check
Later implementation and verification were not supplied.
Structured logs
Trace IDs and JSON logging were in progress.
Evidence to check
Later implementation and verification were not supplied.
All six entries from the June account. None were independently re-verified here.
Read the figure without interaction
The June log reports four completed areas and two in progress. Repository, configuration and measurement evidence is still needed to corroborate the short claims. There is no supplied later completion evidence for passkeys or structured logging.
02 / FIELD NOTESIn progress at the time
The June list included passkey/WebAuthn support alongside the password login, and structured JSON logging with trace IDs.
They remain “in progress in the June account.” Later implementation and verification are not documented in this June account.
03 / FIELD NOTESA correction to the secrets explanation
The original entry said a repository administrator could simply read stored secret values and implied OIDC removed all remaining exposure. That was too broad.
Technical check — September 29, 2026: GitHub documents Actions secrets as encrypted values injected into authorized workflow runs. Its OIDC guidance describes exchanging trusted workflow identity for short-lived cloud access. Permissions, trust conditions, workflow changes, and other secrets still matter. This is a clarification of the explanation, not verification of my old configuration.
04 / FIELD NOTESWhy keep a dated log?
The original reason still holds: a short dated record gives a later case study something concrete to work from.
It also helps keep claims in their proper place. A June entry can explain what I was working on without masquerading as proof of September's deployment state.
The container article looks more closely at the original build examples and the claims attached to them.
Source, dates, and what this page verifies
Based on the complete supplied project/article account. Original publication dates and source URLs are retained. This is an edited reference, not a published update or a new audit of the original application.
Official technical clarifications checked September 29, 2026 are explicitly marked and linked beside the relevant passages. They are distinct from the original author's historical claims. The jq and Docker excerpts remain unchanged and carry their source limitations.
New interactive examples are bounded local teaching tools; they do not scan a website, process credentials, contact AWS, build an image or report a production measurement. No repository, staff account, service terms, résumé, price or live backend was changed.
See docs/batch-6/SOURCE-REVIEW.md for the separation of source-derived claims, external documentation and authored illustrations.