← ALL TAGS

Tag: security

8 articles tagged “security” on Oak Oliver Engineering, newest first. The latest is “Getting Started with Wish in TypeScript: SSH Apps in Six Small Programs”.

Runtime

Getting Started with Wish in TypeScript: SSH Apps in Six Small Programs

A from-zero guide to @oakoliver/wish, the TypeScript port of Charm's wish. Build an SSH server that greets people, recognises them by key, runs commands and serves a Bubble Tea app to every session, then share state between sessions and make it safe to expose. Every program runs on Node and Bun.

November 1, 2026 12 min read
Read Story →
Runtime

Porting Go's Wish to TypeScript: SSH Apps and Bubble Tea over SSH

Charm's wish, the Go library for building SSH apps, is now a TypeScript package on top of ssh2: an SSH server with middleware, one Bubble Tea program per session, Git and SCP. 154 tests on Node and Bun, and the key-generation bug that hid behind a flaky test.

November 1, 2026 12 min read
Read Story →
Runtime

One JSON Document, Live Data: Adding Data Bindings to oak-ui and Running It as a Vibe

oak-ui describes a whole app as one JSON document, but the document could only show data it already contained. Version 1.1 adds sources, bindings and commands against the app's own API: each distinct request fetched once per resolution pass, dependencies resolved in waves, paths that can't leave /api/, and API data that is never evaluated as code. Then we taught the vibe platform to serve app.oak.json as a page, fought a CSP over fonts, and shipped the first real oak-ui vibe to production.

September 28, 2026 12 min read
Read Story →
Security

Server-Side API Key Injection: An LLM Proxy That Hides Your Keys and Meters Cost Per Request

How Vibe's AI proxy injects its Gemini key on the server so browser code never sees them, and why it meters each request's cost at the proxy, before and after the call, instead of working it out from logs later.

February 14, 2026 16 min read
Read Story →
Framework

I Deleted Every Password From My Database. Here's Why My Users Are Safer Than Yours.

How I built passwordless authentication with magic link tokens, GitHub/Google/LinkedIn OAuth via Arctic with PKCE, JWT httpOnly cookies, and Elysia.js middleware — and why the password era needs to end.

January 28, 2026 10 min read
Read Story →
Architecture

HMAC-Signed Vibe-to-Vibe Calls: How We Stopped Micro-Apps from Impersonating Each Other

Inside the HMAC-signed request protocol that secures inter-app communication on the Vibe platform — where every micro-app runs in its own Cloudflare Worker sandbox and no one trusts anyone.

January 27, 2026 20 min read
Read Story →
Architecture

Layered Authorization in Elysia.js: Why Your Middleware Is Doing Too Much

How we built composable authorization layers using Elysia's derive() and scoped middleware — replacing a monolithic auth check with elegant derive chains that narrow permissions at every step.

January 25, 2026 18 min read
Read Story →
Architecture

We Use Subdomains as Security Boundaries. No Kubernetes. No Containers. Just Directories.

Inside Vibe's multi-tenancy architecture where every user's micro-app gets its own subdomain, filesystem, derived secret key, and SQLite database — all on a single server process.

January 19, 2026 8 min read
Read Story →