A proof of concept for delivering an API credential through Declarative Device Management and letting a signed broker use it, so MDM scripts can trigger an authenticated request without ever holding the secret. Includes the signing, install-behavior, and asset-hosting problems that cost me most of two days.
How a SwiftDialog-driven backup script grew into a resumable, self-healing pipeline: rsync with stall recovery, encrypted DMG archives, a launchd-driven NAS queue with checksum verification, and a signed package built over a hundred times.
How a single committed secret inspired a complete rethinking of Jamf Pro script management, and the open-source framework that came out of it. Presented at JNUC 2026, Kansas City, MO.
How I forked App Auto-Patch to fix users being re-prompted for weeks: an accumulating discovery cache that locks on install day, a cadence gate, a cache-only Self Service workflow, and a pile of lessons about 1Password’s background processes.
A one-day security review changed this self-service admin tool from a timer and user-writable state into a root-owned record with multiple revocation backstops.
A Self Service tool that shows users their pinned packages, IT policy, available updates and known vulnerabilities for Homebrew, then lets them update on their own. Most of the design came down to deciding which data to trust locally and which to ask the Workbrew API for.
A walkthrough of a Fleet device management GitOps repo: how the YAML is organized by platform, how labels, policies, and software are scoped, and how CI dry-runs every pull request before anything is applied.
What started as an offline drafting app for a travel blog became a native Ghost editor with careful sync, local and server comparison, and a review handoff. Notes on what’s built, what blocks a beta, and how I’m thinking about whether to sell it.
What I put in a half-day workshop on versioned, secret-scanned, linted macOS script repos: Gitleaks, ShellCheck, semantic versioning, CI, and what to do when a secret is already in your history.
A security-first architecture for JIT admin and MDM automation that keeps directory API secrets off managed Macs.