-
Read, write, critical: permission tiers for a local AI agent
Every tool call my local AI agent makes is rated read, write or critical. Writes need my approval, critical actions need a one-time code bound to that exact operation, and unattended runs only propose.
-
Why local LLMs could not drive an autonomous pentest agent
I tuned an autonomous security-testing agent until the mechanics were clean, then watched my local 27B model read 1.44 million tokens and find none of three planted bugs. Here is how to separate fixable plumbing from a model that cannot do the job.
-
Authelia SSO pitfalls: a policy protects nothing if the route skips it
Three services my Authelia config marked two-factor served pages to anyone: the Traefik routes never called Authelia. Six SSO pitfalls from a home lab, all fixed, with config.
-
Why my long CrowdSec bans vanished after two days
CrowdSec's alert flush deleted my year-long bans after ~48 hours, a systemd timer sat dead for 24 days, and the fix triggered 18 router re-add storms. Mechanisms and fixes.
-
Falco on Linux 7.0: 222 restarts and a BPF verifier error
Falco 0.43 restarted 222 times on a Linux 7.0 kernel. The path to the fix: OOM kills, dropped syscalls, a BPF verifier rejection fixed in Falco 0.45.1, and Helm 4 server-side apply conflicts.
-
One password in 13 places: inventory and rotation of home-lab secrets
An inventory found 62 plaintext credentials in my workload specs and one password reused 13 times. How I moved them into Secrets, built a pointer registry on Vaultwarden, and rotated with proof.
-
Signing threat intelligence: Merkle trees, Ed25519 and one float
Every threat-intel dossier I publish carries an Ed25519-signed Merkle root anchored in Bitcoin. The method, a TAMPERED bug caused by 90.0, a verifier that trusted itself, and how to correct signed reports.
-
120 fake Googlebots, 9 real ones, and the week I banned Google
ASN checks let 77 fake Googlebots on Google Cloud through. How I verify crawlers with published IP ranges and forward-confirmed rDNS, ban impostor fleets, and how I accidentally banned the real Googlebot.
-
My SSH honeypot accepted every password, so it never banned anyone
194 attacker IPs escaped my honeypot's auto-ban for three months because it waited for failed logins. Lessons on ban-on-connect and building a honeypot log pipeline that fails loudly.
-
9,151 critical CVEs, mostly in images I wasn't running
My weekly Trivy report counted 9,151 criticals across 1,925 images; only 152 were running. How I scoped the scan, cleaned old tags safely, triaged by fixable, and patched a PHP RCE the same day.
-
A self-hosted classroom with SSO-only login and token-locked Jitsi
Version 1 of my self-hosted classroom had two logins, a 'changeme' API key and Jitsi secrets in Git. Version 2 uses SSO headers only, roles from groups and per-room Jitsi tokens. The design and the traps.
-
How my Kubernetes dashboard locked me out of my own SSO
Headlamp's backend retried a dead OIDC refresh token every 5 seconds with no backoff, and Authelia's per-IP rate limiter then blocked my own login. The wrong theory, the upstream race, a Helm drift landmine and the watchdog that caps it.