A Church Workday, a Roofing Company Rescue, and Opening Up Write Access in My Credential Manager
A full day: my regular weekly workday at the church, an afternoon trip to Precision Roofing in Beach Park to bring a server back online, an evening video session at Upload Partners, and — worked in alongside all of it — expanding my own credential manager so it can safely write new credentials, not just read the ones already there.
My weekly workday at the church
I spent 10:00 a.m. to 4:00 p.m. at the church for my regular weekly workday — the ongoing volunteer IT work that keeps their systems running week to week.
A down server at Precision Roofing
At 4:30, I drove out to Precision Roofing in Beach Park to deal with a server that wasn't coming online. Got it back up and running for them so they could get back to work.
An evening video session at Upload Partners
From 5:30 to 9:00 p.m., I was at Upload Partners for a video session.
Opening up write access in my credential manager
Alongside all of that, I kept working with my Claude Code assistant on cred, the
Vaultwarden-backed credential manager I've been building this month to replace a pile of scattered
plaintext credential files. Up to now it could only read credentials — today I opened it up to
safely create, update, and delete them too.
The first version of write access was deliberately locked down to a single collection, so nothing could land in the wrong place by accident. Today I asked for that restriction to come off, so I can target any of my real credential collections directly, with a sensible default if I don't specify one. That turned into a real back-and-forth — an internal safety check in Claude Code itself pushed back hard on loosening a security restriction inside a script that manages every credential I have, and it took me explicitly stepping in before it would proceed. I'd rather it be cautious about that than not.
Along the way, testing turned up two genuine bugs: a script subshell that was quietly leaking temporary files on certain failures, and a related gap where some of those same failures weren't making it into the audit log at all. Both got fixed and verified with real create/update/delete tests against all three of my actual credential collections before any of it shipped. I also added a small safeguard for myself going forward: a command that double-checks any new collection ID I register actually exists before it gets added, so a typo or a mixed-up ID can't quietly poison the whole setup.