Blog
Thoughts on engineering, products, and building software.
Engineering
Killing GitHub PATs: trading OIDC tokens for scoped GitHub App credentials
Why we built a broker that exchanges a GitHub Actions OIDC identity token for a short-lived, least-privilege GitHub App installation token, gated by CEL policy.
André LorethEngineering
Self-hosted tunnels with real SSO: frp plus a CEL policy engine
ngrok gates team SSO behind paid tiers and Cloudflare Tunnel locks you into its Zero-Trust model. We self-host frp instead, and wrote a CEL-based server plugin so our own IdP decides who can proxy what.
André LorethEngineering
oidc-token-cli: one OIDC client for every tool
Why we built a small Go CLI that fetches and caches OpenID Connect tokens, so kubectl, frpc, curl, and CI never have to implement auth themselves.
André LorethNews
Why we built abi group
A first note from the founders: what abi group is, why we started it, and what we hold to.
André Loreth