Hi, I'm Jake.

jstgtech.com — this site

A static blog and portfolio on Astro 7 + Tailwind 4, deployed to S3 + CloudFront with Terraform-managed infrastructure and full CI/CD.

AI content pipeline with human approval

GitHub Actions workflows where Claude researches and drafts blog posts daily, and nothing publishes until a human approves it in the CMS.

Serverless GitHub OAuth for Sveltia CMS

A stateless AWS Lambda that self-hosts the GitHub OAuth handshake for a git-based CMS — no third-party auth service, secrets in SSM.

Aug 10, 2026

Diagnosing and fixing Lambda cold starts that matter

A practitioner guide to measuring Lambda Init Duration, trimming package bloat, and deciding when provisioned concurrency is worth its always-on cost.

Aug 10, 2026

CI/CD for a static site: build, sync, and invalidate

How to structure a GitHub Actions pipeline that builds a static site, syncs it to S3 with correct cache headers, and invalidates CloudFront without overpaying.

Aug 14, 2026

The Capital One breach: an SSRF bug into 100M records

A misconfigured WAF and an SSRF bug let an attacker reach the AWS metadata service and steal role credentials — exposing 100M+ Capital One records.

Oct 13, 2026

Storm-0558: When a Stolen Signing Key Forges Any Token

A single stolen token-signing key let attackers mint valid cloud identities and read email in about 25 organizations. Root cause, blast radius, and what to do about your own keys.

Oct 9, 2026

CircleCI Breach: Stolen Session Cookies and Your CI Secrets

One infected engineer laptop, one stolen SSO session, and every customer secret in CircleCI was in play. What failed, the blast radius, and how to make CI secrets cheap to rotate.

Oct 6, 2026

The chalk/debug npm Compromise: Anatomy of a Package Hijack

One phished maintainer turned 18 ubiquitous npm packages into a crypto-stealing payload in about two hours. Here is how it worked and the build-pipeline controls that blunt it.