A heavy day across six repos. Rather than list commits, here's the through-line: almost everything was about making an implicit thing explicit — an implicit redaction rule, an implicit assumption that the database matches reality, an implicit colour palette baked into a rendering engine.
1. Secret scrubbing, as a package
cleaniquecoders/pii-protection picked up three pieces: SecretScrubber (pattern-based — PEM blocks, JWTs, URL credentials, AWS key IDs, KEY=value assignments), LiteralScrubber (mask exact values the caller already holds), and RedactedStrategy (fixed placeholder, no length preserved).
The design decision I keep coming back to: secrets and PII are separate passes on purpose. Point a PII scrubber at an infra log and it deletes the IP addresses you need to debug, while leaving the connection string untouched.
Also: don't mask credentials with a length-preserving strategy. ******* tells an attacker the value was seven characters.
Written up properly in a separate post.
Repo: cleaniquecoders/pii-protection
2. Drift reconciliation and a scaling engine
On a private deployment platform: a scheduled drift reconciler and a real scaling engine. Both landed as "observe → compare to intent → decide → act", behind contracts, driven by scheduled commands.
The rule that made it worth building: actual state is read from the provider, not from our own tables. A row saying "running" beside a VM that no longer exists is precisely the drift you're looking for — counting rows reports a healthy deployment right until someone tries to use it.
Second lesson, learned the annoying way: no baseline means unknown, not drifted. The first version flagged every layer of every pre-existing deployment.
Also separate post.
3. A hand-rolled redactor, deleted
Small commit, disproportionate satisfaction. The same platform had a bespoke LogRedactor — three regexes, no tests, written inside a feature ticket because nobody budgets a week for a redactor. It now delegates to the package above.
That's the whole case for extracting things: the standalone version gets the tests and the edge cases, because it's the only thing in the repo.
4. Email automations get an identity
On a private CRM: sequences gained a sender identity, a preview, a test send, goals, and analytics.
The interesting bit is goals. A sequence without a goal can only report "did it send". With a goal — replied, booked, purchased — it can report whether it worked, and stop emailing someone who already converted. That's one enum and one table, and it changes what the whole feature is for.
Worth noting for anyone building sequences: "preview" and "test send" are different features. Preview renders the merge fields against a sample contact; test send proves your sender identity, SPF and DKIM actually work. Shipping only the first is how you discover deliverability problems in production.
5. Extracting a book engine from the workspace it grew in
A private tooling project got the treatment every internal tool eventually needs: pull the engine out of the workspace it grew inside, and make everything it silently assumed into configuration.
The specific change I liked: the colour palette moved out of the rendering code and into the book's own config, alongside a token table applied across four output surfaces. Before, a "theme" was a patch. After, it's a file — and the proof it's a real seam is that two themes exist and look genuinely different.
Also a sanitisation pass to strip workspace-specific paths out of the engine. If your tool only works from one folder on one machine, it isn't a tool yet.
6. Public sites
- The company site: dependency upgrade clearing all outstanding advisories, plus a correction to the business address and the map coordinates. Boring, necessary — a wrong map pin is a support ticket generator.
- A new public site for a community summit went up. First commit, plain and static.
The through-line
Four of six items were the same move: something that was working fine as an assumption became a named, tested, configurable thing. A redaction rule became a package. "The DB is right" became a provider probe. A palette became a config file. A sequence's success became an enum.
None of them added a feature users would name. All of them made the next feature cheaper.
Top comments (0)