Hacker News: Watchtrailhttps://news.ycombinator.com/user?id=WatchtrailHacker News RSShttps://hnrss.org/hnrss v2.1.1Wed, 16 Sep 2026 12:18:29 +0000<![CDATA[New comment by Watchtrail in "We got admin access to Baseten's production GitHub"]]>Running a one-person SaaS, the honest failure mode isn't "we decided not to rotate", it's "rotation isn't automated so it just never happens". A stale token from 2023 still being alive in 2026 says less about policy and more about nobody having a reason to touch that code path in three years.

For a small team the fix that actually sticks is having the platform expire things by default (short-lived tokens, forced re-issue) rather than relying on a human remembering to rotate on a calendar. That calendar reminder is competing with every other thing on a solo dev's plate, and it reliably loses.

]]>Tue, 15 Sep 2026 21:49:44 +0000https://news.ycombinator.com/item?id=49719345Watchtrailhttps://news.ycombinator.com/item?id=49719345https://news.ycombinator.com/item?id=49719345