Date: 2026-08-11
Repository: https://github.com/gastownhall/beads
Version: v1.1.2 + 2 weeks of unrelease commits
Commit SHA: 18c24a3ac3e737c34cb478d58ecf3a805a99e996
Scope: Full security audit of a Go CLI tool for issue tracking with Dolt/SQLite backends, git sync, and AI agent integration.
Methodology: glm-5.2-max investigation covering 300+ Go source files, dependency manifests, CI pipelines, and install scripts, searching for unintentional and malicous security issues.
Edward Anderson nilbus
nilbus
/ BEADS_SECURITY_AUDIT.md
Last active
August 11, 2026 16:20
Security audit findings: beads (bd) CLI - 11-category audit of a vibe-coded Go codebase. No malicious code detected; 4 medium + 6 low conventional findings.
Your big feature is tested and ready to go! Time to merge, and then…
Nooooo! 😭 Memories arise of hours of uncertainty spent trying to resolve past conflicts. Sure, there are lots of UIs that make picking one side or the other easier than using the command line, but is picking sides really the right answer?
I’ll share a hidden gem that, for me, has turned conflict resolution from frustration into something of a joy. Git has a built-in feature that you can enable called the diff3 conflict resolution strategy. Turning this setting on enables a predictable approach to understanding and resolving the conflicts you encounter.
I’ll note that git conflicts can be minimized through practices such as Trunk Based Development with Feature Flags, breaking features into smaller chunks that you can deliver incrementally, and refactoring hotspots
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| GEM | |
| remote: https://custom.source/repository/gems/ | |
| specs: | |
| <<<<<<< ours | |
| active_model_serializers (0.10.13) | |
| actionpack (>= 4.1, < 7.1) | |
| activemodel (>= 4.1, < 7.1) | |
| case_transform (>= 0.2) | |
| jsonapi-renderer (>= 0.1.1.beta1, < 0.3) | |
| activerecord-import (1.2.0) |
nilbus
/ detect_leaks.rb
Created
December 20, 2022 21:16
Ruby code for dumping and diffing heap dumps to find memory leaks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| require 'set' | |
| require 'json' | |
| require 'objspace' | |
| DIFF_FILENAMES = ['/tmp/1.json', '/tmp/2.json', '/tmp/3.json'] | |
| def dump_memory(n) | |
| BatchLoader::Executor.clear_current | |
| GC.start | |
| file = File.open("/tmp/#{n}.json", 'w') |
nilbus
/ detect_leaks.rb
Last active
July 22, 2021 02:24
Find objects that aren't getting garbage collected. Usage: detect_leaks { some_code }
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Adapted from https://blog.skylight.io/hunting-for-leaks-in-ruby/ | |
| require 'set' | |
| require 'json' | |
| require 'objspace' | |
| DIFF_FILENAMES = ['/tmp/1.json', '/tmp/2.json', '/tmp/3.json'] | |
| def dump_memory(n) | |
| BatchLoader::Executor.clear_current | |
| GC.start |
nilbus
/ count-disruptive-migrations.sh
Last active
February 19, 2020 16:45
Count the number of migrations per repo that modify existing schema structure
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # make a temp directory for each repo to examine | |
| mkdir doximity doc-news activities | |
| # copy in migrations from 2019 | |
| for dir in *; do cp ~/work/$dir/db/migrate/2019* $dir/; done | |
| # remove migration reversal code to exclude from search | |
| sed -i'' -re '/def down/,$d' */* | |
| # count unique migration files per repo that modify existing schema structure (tables, columns) |
nilbus
/ error1.txt
Last active
November 4, 2019 14:08
Error log messages produced in Console app when trying to open the context/right-click menu for podcasts created from local files in pre-catalina iTunes by changing the tracks' media kind to "Podcast". I cannot access the context menu for these podcasts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| *** -[__NSArrayM insertObject:atIndex:]: object cannot be nil |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| GIT-ABSORB(1) git absorb GIT-ABSORB(1) | |
| NAME | |
| git-absorb - Automatically absorb staged changes into your current branch | |
| SYNOPSIS | |
| git absorb [FLAGS] [OPTIONS] | |
| DESCRIPTION | |
| You have a feature branch with a few commits. Your teammate reviewed the branch and |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| " Reset autocommands from previous load | |
| au! | |
| " Load pathogen plugins and reload their help files | |
| call pathogen#infect() | |
| call pathogen#helptags() | |
| " Set leader key to space | |
| nmap <Space> <NOP> | |
| let mapleader = "\<Space>"" |
NewerOlder