Skip to main content

The Silent Exfiltration — Why Your CI Pipeline Is an Open Vault

· 17 min read
Ivan Baha
Software Team Lead & Architect

Modern CI/CD pipelines for Node.js applications show three worsening structural issues — secrets injected into the runner environment at the start of the pipeline, unrestricted npm lifecycle script execution during dependency installation, and open outbound network access on CI runners — which together enable silent, zero-alert credential exfiltration by any malicious package in the dependency tree. These findings are platform-independent: GitLab CI, GitHub Actions, and similar systems all have identical default insecure settings. The March 2026 compromise of the Axios npm package, a North Korean state-sponsored supply chain attack targeting a library with about 100 million weekly downloads, is discussed as a real case study confirming the large-scale exploitation of this attack surface.

The AI-Native Team Workspace: Solving the Multi-Repo Context Crisis

· 4 min read
Ivan Baha
Software Team Lead & Architect

Engineering teams are hitting a wall with modern AI coding agents. Tools like GitHub Copilot Workspace, Cursor, and Claude Code are incredibly capable, but they encounter a severe structural limitation in enterprise environments: they are blind outside their immediate repository.

If your architecture consists of a React frontend in one repo, Node.js microservices in another, and Terraform manifests in a third, an AI agent operating in the frontend cannot trace a failing API call down to the database schema. It lacks the system-wide context required to make accurate, architectural-level contributions.

The "Logical DB-per-Service" Pattern at Scale

· 3 min read
Vladyslava Prykhodko
Engineering Technical Lead & Architect
Ivan Baha
Software Team Lead & Architect

When building distributed systems, the "Database per Service" rule is often seen as a strict rule. The common instinct is to create a separate physical database cluster for each microservice to ensure full isolation. However, as your system expands, managing dozens or hundreds of independent database servers can quickly become an operational nightmare.

Emergent Creativity: An Architectural View on AI Consciousness and Deception

· 5 min read
Ivan Baha
Software Team Lead & Architect

Early artificial intelligence research, which started in the early 1950s, split into two distinct architectural paradigms. The first was a logic-inspired approach that attempted to hard-code intelligence using symbolic expressions and predefined rules. The second, biologically inspired approach posited that intelligence is fundamentally rooted in learning through networks of simulated brain cells. Rather than writing explicit logic, this architecture focused on enabling a system to learn by recognizing patterns and making analogies. It was inspired by research into how our brain works, realizing that biological networks are highly effective at finding analogies and patterns, and then using them to recreate or recognize information.

The "GitOps-Lite" Pattern for Small Projects

· 3 min read
Ivan Baha
Software Team Lead & Architect

When setting up CI/CD for test or staging environments, we immediately want to reach for managed Kubernetes clusters like EKS or GKE. However, for small teams of 1-5 developers and tight budgets, it may not be the best way. A dedicated DevOps specialist and a $70-$100 monthly overhead just for the control plane, on top of main resource costs, sounds a bit extra.