Garrul: The Audit Found My Rate Limiter
A security audit of Garrul, my Cloudflare Workers comment system, found 2 critical bugs. Both had the same root cause as one I had already fixed in June.
Tag: security
All the articles with the tag "security".
Bots Ate 90% of My Worker Quota
A WordPress login bot burned 90% of my Cloudflare Workers free tier in two hours attacking a site that has never run PHP. Here's what actually stopped it.
3-2-1-1-0: The Backup Strategy That Survives Ransomware
3-2-1 backups aren't enough anymore. The 3-2-1-1-0 rule adds immutable & offline copies plus verified restores, here's how to implement it.
SSH Bastion & Jump Host Patterns That Don't Hurt
Stop opening port 22 to the world. SSH bastion hosts, ProxyJump chains, session recording, and self-hosted Teleport alternatives that actually work.
systemd-homed: Portable Encrypted Home Directories
systemd-homed turns your home dir into a portable LUKS-encrypted blob. Move it between machines, unlock with FIDO2, and own your own data.
SOCKS5 Over SSH: Selective Routing Without a VPN
Route only the traffic you want through a SOCKS5 proxy via ssh -D. Browser extensions, curl, git, ProxyChains, autossh, and DNS leak gotchas, no VPN needed.
Your Agent Doesn't Need a Shell
Coding agents get unrestricted shell access by default because it's easy, not because they need it. Here's the short list of what actually breaks without one.
Sandstorm: Self-Hosted Apps in a Sandbox, Not Just a Container
Sandstorm gives every app instance its own capability-gated sandbox. Different threat model than a Compose stack, here's what that actually means.
Where Should Your Coding Agent Run?
Claude Code and other AI coding agents need somewhere to run. Compare laptop, Docker, throwaway VMs, and Cloudflare Workers on blast radius, cost, and setup.
Go on Scratch: Docker With No OS at All
A Go binary on FROM scratch gives you a 10 MB image with no shell, no libc, no /tmp. Everything that breaks on an empty filesystem, and how to fix each one.
OPA & Rego: Policy as Code Beyond Kubernetes
OPA and Rego aren't just Kubernetes gatekeepers. Block :latest tags in CI, enforce Terraform resource tags, and filter HTTP APIs.
Vaultwarden Behind Authelia: 2FA That Holds
Lock down your Vaultwarden with Authelia forward auth, two-factor authentication at the proxy layer before a single byte reaches your password vault.