This week on Ship It Weekly, Brian looks at four “glue failures” that can turn into real outages and real security risk.

We start with CodeBreach: AWS disclosed a CodeBuild webhook filter misconfig in a small set of AWS-managed repos. The takeaway is simple: CI trigger logic is part of your security boundary now.

Next is the Bazel TLS cert expiry incident. Cert failures are a binary cliff, and “auto renew” is only one link in the chain.

Third is Helm chart reliability. Prequel reviewed 105 charts and found a lot of demo-friendly defaults that don’t hold up under real load, rollouts, or node drains.

Fourth is n8n. Two new high-severity flaws disclosed by JFrog. “Authenticated” still matters because workflow authoring is basically code execution, and these tools sit next to your secrets.

Lightning round: Fence, HashiCorp agent-skills, marimo, and a cautionary agent-loop story.

Links

AWS CodeBreach bulletin https://aws.amazon.com/security/security-bulletins/2026-002-AWS/

Wiz research https://www.wiz.io/blog/wiz-research-codebreach-vulnerability-aws-codebuild

Bazel postmortem https://blog.bazel.build/2026/01/16/ssl-cert-expiry.html

Helm report https://www.prequel.dev/blog-post/the-real-state-of-helm-chart-reliability-2025-hidden-risks-in-100-open-source-charts

n8n coverage https://thehackernews.com/2026/01/two-high-severity-n8n-flaws-allow.html

Fence https://github.com/Use-Tusk/fence

agent-skills https://github.com/hashicorp/agent-skills

marimo https://marimo.io/

Agent loop story https://www.theregister.com/2026/01/27/ralph_wiggum_claude_loops/

Related n8n episodes:

https://www.tellerstech.com/ship-it-weekly/n8n-critical-cve-cve-2026-21858-aws-gpu-capacity-blocks-price-hike-netflix-temporal/

https://www.tellerstech.com/ship-it-weekly/n8n-auth-rce-cve-2026-21877-github-artifact-permissions-and-aws-devops-agent-lessons/

More episodes + details: https://shipitweekly.fm