a workspace pod should not be a server. it should be a socket. vmrun is a go cli that opens a kubernetes job, sshes into it, and lets the pod die when you walk away. nothing …

a password is a string you can type, which means a string you can leak. a yubikey is a secret you cannot type, cannot read, and cannot extract. it answers challenges without ever …