Dev Log — Q2 2026: auth, scanning, and less YAML

A running changelog of the security and tooling work that shipped this quarter across the projects here.

A short retrospective of what actually shipped in Q2 — kept terse on purpose, changelog-style.

Shipped

• Migrated all CI deploys off long-lived cloud keys to OIDC. The old setup had static cloud credentials sitting in repo secrets, which is a standing liability — anyone with repo-admin access could read them, and they don't expire on their own. OIDC short-lived tokens replace that: CI requests a token scoped to a single run, and there's nothing left in repo settings for a leak to expose.
• Added gitleaks + trivy as pre-commit hooks across three repos. The first run caught two stale test API keys that had been sitting in a fixtures file for months — exactly the kind of thing that's invisible until someone greps for it, or worse, until someone else does. See the container hardening guide for the trivy side of this.
• Cut the Atlas Market image from ~1.1 GB to ~180 MB by moving to a distroless runtime — full write-up in Hardening Container Images.
• Replaced a homegrown session store with standard OIDC on the internal dashboard.

In progress

• Passkey / WebAuthn support alongside the existing password login.
• Structured JSON logging with trace IDs so log auditing stops being grep archaeology.