Writing

Sam James's Articles – Page 2

Discover expert insights from Sam James on Security, Magento 2, DevOps, AI Development, Infrastructure. Stay updated with the latest trends, practical guides, and in-depth analysis in Magento & Ecommerce.

GitHub Webhook Secret Exposure via x-github-encoded-secret Header

How GitHub accidentally leaked webhook secrets via an erroneous HTTP header, what data was exposed, and the exact steps to rotate your secrets now.

Magento 2 Polyshell RCE: Technical Breakdown, PoC & Patch Guide

Deep dive into the Magento 2 Polyshell remote code execution vulnerability — how it works, how to test if you're affected, and how to apply the patch.

Adobe's Isolated Patch Strategy: A Community Response

Adobe's new monthly isolated patch approach for Magento creates maintenance burden. Here's how a community meta-package can help restore sanity to security patching.

Strengthening Magento 2 Security in CI/CD Pipelines with Sansec Ecomscan

Learn how to integrate Sansec Ecomscan into Magento 2 CI/CD pipelines to detect malware, enforce security patches, and secure build artifacts. Step-by-step guides for GitHub Actions and Bitbucket Pipelines included.

AI Experiments for Frontend, SEO and UI Design

I rebuilt small projects to test AI for frontend, SEO and UI. Here’s what helped, what broke, and how I’d use it again.

Cloudflare Outage November 2025 - Retrospective

Cloudflare accidentally took half the internet down for half a day, right before Black Friday. What can we learn from this, and how can we engineer more resilient infrastructure to survive similar outages in the future?

Check if your Magento site is safe from Session Reaper (CVE-2025-54236)

How to guide on checking if your Magento 2 store is safe from the Session Reaper (CVE-2025-54236) exploit. And guidance on how to patch and secure your site if it is not.

How to efficiently patch Magento 2 deployments at scale

Approaches to simply deploying patches across a large inventory of Magento 2 deployments

Verbose Magento 2 DB Schema Status

Ever found yourself wondering why a store required downtime to deploy? Or even the case where `setup:db:status` constantly reports `Declarative Schema is not up to date` despite you just update it?

Is Self-Hosted Sentry Worth It? A Year Running It in Production

A year of self-hosted Sentry in production: 9 to 11 million events a month on a ~£30 Hetzner server, disk-space scares, flaky cleanup and updates.