Research, engineering notes and numbers from the Quorum team. A new post every two weeks.
6 min read
What a leaked Stripe key costs in the first hour
A live key in a public build log is found by scrapers in minutes. Here is what we saw, and what the fix looked like.
Nadia Brennan
8 min read
We only open a pull request when we can show the path
A vulnerable package you never call is not an emergency. Here is how we decide what deserves a pull request.
Marcus Hale
5 min read
Two approvals, not zero: why Quorum will never auto-merge
We get asked for auto-merge every week. Here is why the setting does not exist.
Elena Voss
7 min read
Scanning 1,284 resources an hour in four minutes
How the scanner stays fast enough to run every hour without making your cloud bill notice.
Owen Park
6 min read
Public buckets are still our most common critical finding
Six years after the defaults changed, open storage is still where most critical findings start.
Nadia Brennan
9 min read
How we write a Terraform fix you would write yourself
A fix is only useful if it looks like your code. Here is how we match naming, modules and formatting.
Owen Park
Run a free scan on one repo
Connect one repo and one cloud account with read-only access. You get the findings and the first fix pull requests within a day, and you keep them either way.