From the studio10 guides · 3 security notes

Blog

Practical guides from the studio: 3D printing, small-business IT, and building software that lasts. Plus the security write-ups, published with the evidence.

Guides

30 Oct 20267 min readSecuritySecretsAccidentally Pushed an API Key or .env File to GitHub? What to Do NextLeaked an API key, password or .env file to GitHub? A calm, step-by-step guide to revoking it, checking for misuse, cleaning history and preventing a repeat.Read the guide

28 Oct 20269 min readSessions vs JWT: Which Should You Use for Web App Login?Sessions or JWTs for your web app's login? How each works, the revocation and storage traps, and secure code for both, in plain English for small teams.BackendAuthentication 25 Oct 20268 min readCore Web Vitals Explained in Plain English (LCP, INP and CLS)What Google's Core Web Vitals actually measure, what a good LCP, INP and CLS score looks like, how to check your site for free, and the fixes that matter most.WebsitesPerformance 23 Oct 20267 min readHow to Set Up MFA for a Small Business (Microsoft 365 and Google Workspace)A step-by-step guide to turning on multi-factor authentication for a small team in Microsoft 365 or Google Workspace, from choosing methods to lockouts.IT supportMFA 21 Oct 20268 min readHow Much Does 3D Printing Cost in Australia? (2026 Price Guide)What drives the price of a 3D print in Australia: material, weight, infill, quantity and postage, with worked examples and when a home printer makes more sense.3D printingPricing 19 Oct 20267 min readHow to Secure Your GitHub Organisation: A Hardening Checklist for Small TeamsA practical GitHub security checklist for small teams covering 2FA, token policies, force-push rulesets, secret scanning and locking down GitHub Actions.SecurityGitHub 16 Oct 20267 min readStripe Manual Capture: How to Hold a Card Payment and Charge It LaterHow to place a card hold with Stripe, capture or release it later, and avoid expired holds and double charges. Node examples for Checkout and PaymentIntents.BackendPayments 14 Oct 20269 min readHow Much Does a Website Cost in Australia? (2026 Price Guide)What a small-business website really costs in Australia: DIY builders vs freelancers vs studios, the ongoing costs nobody mentions, and how to compare quotes.WebsitesPricing 12 Oct 20263 min readPLA vs PETG vs ASA vs TPU: Which 3D Printing Filament Should You Use?A plain-English guide to the four filaments we print with most: what each is good at, where each fails, and how to pick the right one for your part.3D printingMaterials 12 Oct 20263 min readThe Small-Business Offboarding Checklist: What to Do the Day Someone LeavesA practical checklist for teams of 5 to 50 covering accounts, devices, shared passwords and the bits everyone forgets, so ex-staff don't keep access for months.IT supportDevice management

Security notes

Incidents, with the evidence.

Incidents we've had, how we responded and what we changed. Written from the evidence, not from memory.

14 Aug 2026Part threePart Three: Four Layers Deep, What We FoundPulling on the loader chain from part two: remote shell and Python execution, a byte-precise decryption puzzle, and a wall we hit on purpose.Read 14 Aug 2026Part twoPart Two: We Checked If It Was Really DeadConfirming a blockchain-resolved C2 was live, breaking its encryption and finding a four-stage loader chain, all from isolated infrastructure.Read 14 Aug 2026Part oneOne Force-Push, Six Repos: Anatomy of a Blockchain-C2 Supply-Chain WormStolen collaborator credentials, rewritten history across six repos, and how we caught and undid it without cloning a single repo.Read