Full catalog
Every published
knowledge-base article.
Search or filter across all six pillars at once. Draft, in-review, and retired content never appears here.
42 results
A Practical Secure Code Review Checklist
A defensive, risk-focused checklist for reviewing software changes before approval.
Understanding Network Trust Boundaries
How to identify where trust actually changes in a network, place boundaries there instead of at the perimeter alone, and validate that a boundary fails closed — illustrated with a fictional multi-tier architecture.
Threat Modeling a CI/CD Pipeline
A structured method for threat modeling a CI/CD pipeline's trust boundaries — from commit to deployment — using a fictional example pipeline.
Securing API Authentication and Authorization
How token-based API authentication and authorization actually fail in practice, and a repeatable procedure for reviewing object- and function-level checks before they do.
Segmentation vs Isolation
Segmentation and isolation are two different controls, not two names for the same one. A decision test for choosing between them once a trust boundary exists, the failure patterns that come from conflating them, and how each is validated differently — illustrated with a fictional zone architecture.
Protecting the Main Branch Beyond Pull-Request Approval
Why a single required approval is not by itself a defensible main-branch control, and how required status checks, force-push protection, and branch ruleset enforcement close the gap.
Secrets Detection: What Automated Scanners Miss
Why regex- and entropy-based secrets scanners routinely miss real credentials — and the compensating controls that close the gap instead of asking pattern matching to do the impossible.
DNS as a Security Control and Attack Surface
DNS is both a place to enforce security controls — filtering, monitoring, DNSSEC validation — and a protocol attackers abuse in its own right, through cache poisoning, subdomain takeover, and tunneling used as a covert command-and-control channel. A decision framework for treating DNS as a control point instead of invisible plumbing, illustrated with a fictional resolution and tunneling path.
Why Build Runners Should Be Treated as Untrusted
The ephemeral environment that actually runs build and install scripts combines code execution, network egress, and short-lived credentials in one place — why that makes it the pipeline's highest-value target, and what isolation, ephemerality, and least-privilege controls actually limit the resulting blast radius.
Dependency Confusion and Package-Name Trust
How package managers resolving names across mixed internal and public registries can be tricked into installing an attacker-controlled package instead of your own — and the namespace-reservation and single-source resolution controls that close the gap.
TLS Certificate Validation Explained
How a TLS client actually decides to trust a certificate — chain-of-trust path building up to a root trust anchor, hostname verification, and revocation checking — and the specific, common ways that decision gets quietly weakened: soft-fail revocation, disabled verification left over from local development, and self-signed or hostname-mismatched certificates accepted anyway. Illustrated with a fictional certificate chain and a validation-bypass path.
SBOMs: What They Solve and What They Do Not
A Software Bill of Materials gives fast, accurate vulnerability-impact assessment against a known component inventory — and nothing more. What it does not do: prove the software is safe, verify build integrity, stop a malicious dependency from being included, or exceed the accuracy of its own generation process.
Why Input Validation Is Not a Complete Security Control
Input validation confirms a request is well-formed — it does not confirm the request is safe. What validation actually catches, what it structurally cannot, and the authorization, output-encoding, and parameterized-query layers that have to sit alongside it.
Building Firewall Rules from Documented Requirements
A repeatable checklist for turning a documented business or technical requirement into a specific, least-privilege firewall rule, and confirming — through testing rather than assumption — that the deployed rule does exactly what it claims. Illustrated with a fictional two-tier example.
Least Privilege for Pipeline Identities
How to recognize when a CI/CD pipeline identity — a service account, OIDC-federated role, or deploy token — carries more privilege than the job it serves actually needs, and how to reduce that privilege deliberately, in stages, without breaking the pipeline.
SAST vs DAST vs Software Composition Analysis
What Static Application Security Testing, Dynamic Application Security Testing, and Software Composition Analysis each actually catch, what each structurally cannot catch given how it works, and how to combine them into a defensible layered testing approach instead of assuming one tool is sufficient.
Safely Analyzing Packet Captures
A repeatable checklist for handling and analyzing a packet capture without introducing risk to the analyst's own system or corrupting its evidentiary value — covering environment isolation, integrity verification, and treating captured traffic as adversarial by default. Illustrated with a fictional example.
Verifying Build Artifacts Before Deployment
Why a successful deploy step is not evidence that the artifact it shipped is the one your pipeline built from reviewed source, and how to verify that with checksums, cryptographic signatures, and build provenance/attestation before a deploy step is allowed to run.
Preventing Path Traversal Through Boundary Validation
Path traversal happens when an application resolves a user-influenced path against a filesystem boundary it assumed but never enforced. Why blocking literal '../' substrings is a well-known incomplete mitigation, and how to canonicalize a resolved path and verify it against an explicit allow-listed root instead.
How to Validate That a Service Is Not Publicly Reachable
A repeatable checklist for confirming — through an actual external check, not an assumption drawn from a configuration file — that a service intended to be internal-only cannot be reached from the public internet. Covers the common ways a service becomes unintentionally exposed: a misconfigured load balancer, a cloud security-group rule broader than intended, a leftover NAT or port-forward rule, and a service binding to every interface instead of a loopback or internal one. Illustrated with a fictional example.
Preventing Secrets from Entering Build Logs
The concrete mechanisms by which a secret ends up printed in a CI/CD build log — verbose output, environment dumps, error messages, a tool echoing its own arguments — how to prevent each one, and why a secret found in a log must be rotated, not just redacted.
Designing Security Tests for Failure Conditions
Conventional test suites cover the happy path plus a few expected errors, which systematically misses where security decisions actually break: a dependency timeout, a malformed upstream response, a partial multi-step failure, a race around a check-then-act decision. How to deliberately inject each of those conditions and assert the system fails closed, not just that it doesn't crash.
Common Causes of Unexpected Network Exposure
A repeatable audit checklist covering the specific, recurring ways a service ends up reachable from somewhere it was never intended to be reachable from: a load balancer or reverse proxy with a broader listener than intended, a cloud security-group rule left permissive after testing, a service bound to every interface instead of a loopback or internal one, a leftover NAT or port-forward rule, a default-allow rule on a newly provisioned resource, and an internal-sounding DNS record that actually resolves to a publicly reachable resource. Illustrated with a fictional example.
Designing Human Approval Gates for Production Changes
How to design a human-approval gate for a production change — a deploy, a configuration change, an infrastructure change — that provides a meaningful check instead of a rubber-stamp click: what an approver actually needs to see, why instant unanimous approval is a red flag, separation of duties, and what can safely skip a human gate.
Designing Fail-Closed Security Automation
Why security automation drifts toward fail-open by default — uncaught exceptions, permissive branches, leftover bypasses, and timeouts that assume the safe outcome — and how to design a control that fails closed by construction: explicit allow-lists, treating 'cannot determine' as its own denying outcome, and a deliberate circuit breaker for the controls where fail-closed itself is the greater risk.
A Backup Is Not Proven Until It Is Restored
A checklist for verifying that a backup is actually recoverable — distinguishing a backup job's success signal from demonstrated restoration into an isolated environment, with fictional examples throughout.
Designing Human Approval Gates for AI Agents
How to design an approval gate for an autonomous AI agent's tool-driven actions — file writes, shell commands, API calls, merges — that holds even when the agent's own reasoning has been manipulated: classifying actions by reversibility and blast radius, enforcing the boundary outside the agent's output, why prompt injection defeats an instruction-only gate, and what rollback looks like for an ungated action.
Planning a Zero-Change Docker-to-k3s Migration
"Zero-change" usually means the application behaves identically before and after a migration — it says nothing about whether the platform's default security posture came along for the ride. A deep-dive into five places a Docker-to-k3s migration silently changes trust boundaries even when the workload's own code and configuration never change: the control-plane surface, the network model, the default exposure surface, per-workload identity, and secrets storage — and what to verify, on the new platform, before trusting the zero-change claim.
Building a Secure Internal Reverse Proxy
Design principles for an internal reverse proxy: why TLS termination creates a trust boundary, why proxy-added headers must never be trusted blindly, how to authenticate the proxy to its backends, how to prevent the proxy itself from becoming an SSRF vector, and how to enforce access control at the proxy layer — illustrated with a fictional internal service.
The Security Risks of Mounting docker.sock
Mounting docker.sock into a container does not grant a scoped slice of Docker functionality — it hands the container a live client connection to the full Docker Engine API, which Docker's own documentation and OWASP both describe as equivalent to root access on the host. A deep look at exactly what that access grants, why marking the mount read-only does not meaningfully reduce the risk, and three concrete, more defensible alternatives: removing the mount entirely, rootless Docker, and a scoped API proxy.
Logs Are Not Proof: Verifying Automated Actions
A guide to verifying that an automated security action — a firewall-rule deployment, an access revocation, a patch rollout, a quarantine action — actually produced its intended effect, distinguishing a completion signal (exit code, log entry, dashboard status) from independently verified evidence, with fictional examples throughout.
Hardening a Private Gitea Server
A self-hosted Gitea instance is both source-of-truth for code and, once Actions or webhooks are involved, part of the supply chain. Concrete hardening steps for authentication and enforced 2FA, SSH and deploy-key scoping, webhook secret verification, repository and organization access control, patch cadence, backup, and network exposure — illustrated with a fictional organization throughout.
Threat Modeling AI Agents with Tool Access
A method for threat modeling an AI agent's tool-access attack surface — file writes, shell commands, network calls, API keys — by enumerating its tool inventory as trust boundaries and mapping each identified threat to least privilege, human-approval gates, audit logging, or execution sandboxing.
Prompt Injection in AI-Assisted Engineering
What prompt injection actually is for AI coding and agentic tools — direct versus indirect injection, why the SQL-injection/XSS comparison helps but breaks down, and the landscape of mitigations: untrusted-data framing, least-privilege tool scoping, human approval for consequential actions, and instruction/data provenance separation.
Preventing Sensitive Data Leakage Through AI Tools
How sensitive data — source code, customer data, credentials, and internal documentation — actually leaks through AI-assisted tools: an unclear-retention chat interface, an agent's own tool output and logs, an overly broad context window, and a third-party plugin or MCP server with its own data egress path. Covers concrete mitigations that hold up against routine use: classifying data before it reaches an AI tool, reviewing a tool's actual data handling before adoption, scoping and redacting what an agent can read and log, and auditing what actually left the boundary.
Workload Identities vs Long-Lived Credentials
Why a long-lived static credential embedded in a workload — an API key, a service-account key file, a hardcoded secret — is a persistent, high-value target, and how a workload identity mechanism (short-lived tokens bound to the workload's attested runtime context) removes the need to provision or store one at all, along with where that mechanism still needs correct scoping and does not fully apply.
Cloud IAM Permission Creep
Why cloud IAM permissions accumulate over time even when every individual grant seemed reasonable, why that drift is structurally hard to detect from a point-in-time permission snapshot, and how to review and reduce standing privilege using access-analyzer evidence, time-bound access, policy-as-code review, and owned, scheduled de-provisioning.
Kubernetes RBAC Design Principles
How Kubernetes RBAC's Role/ClusterRole and RoleBinding/ClusterRoleBinding object model actually scopes permission, why a namespace-scoped Role should be the default and a ClusterRole reserved for genuinely cluster-wide needs, three common RBAC anti-patterns (wildcard grants, convenience cluster-admin bindings, over-permissioned ServiceAccounts), and how to verify a subject's actual effective permission with kubectl auth can-i rather than trusting a Role's YAML alone.
Why Container Health Is Not Security Validation
A liveness probe, a readiness probe, and a `Running` pod status only prove a container's process is alive and responding — not that it is running securely. A container can be reported healthy while running as root, with an exploitable dependency, a writable root filesystem, excess Linux capabilities, or active compromise, and an adversary who wants to persist undetected has every incentive to keep the health check passing. What actually validates security posture is a different control category entirely: image scanning, admission-control policy, runtime security monitoring, and periodic configuration audits.
How to Scope an Authorized Security Assessment
How to define the scope of an authorized penetration test before any testing begins: what belongs in a written scope document and rules of engagement, why signed written authorization has to exist first, and how scope decisions shape what a defender should expect to see in their own detection systems during the engagement window.
Turning an Attack Hypothesis into a Detection
A worked, synthetic-data walkthrough of turning a falsifiable attack hypothesis into a maintainable detection — from telemetry validation and vendor-neutral logic through a synthetic test corpus, false-positive analysis, and tuning.
Rules of Engagement for an Isolated Lab
The foundational rules-of-engagement and isolation baseline for authorized offensive-security lab exercises: what written authorization and scope need to cover, what actually makes a lab isolated rather than merely separate, and how to handle findings safely afterward.