Your Own .onion Site From Scratch: Vanity Addresses, Stealth Onions, and Real Hardening
Set up hardened Tor v3 onion services with vanity addresses, client authorization, and comprehensive security hardening techniques.
Security
Explore threat detection, vulnerability management, and hardening strategies for Linux systems, cloud infrastructure, and software applications.
mTLS from Scratch in Go and Rust: Lock Down Your Services Without a Service Mesh
Implement mutual TLS for service authentication in Go and Rust. Generate certificates, set up your CA, and secure internal services without service meshes.
OWASP Top 10 2025 Walkthrough: Stop Copying Security Checklists — Here’s What Actually Fixes Things
OWASP Top 10 2025 explained with vulnerable code and real fixes. Understand broken access control, injection, and critical vulnerabilities.
Container Image Scanning at Scale: Harbor, Quay, and ECR Compared
Container image scanning at scale: compare Harbor, Quay, and ECR for registry scanning, CVE monitoring, and securing thousands of images in production.
Stop Hardcoding DB Passwords: HashiCorp Vault Dynamic Credentials in Production
Replace static database credentials with HashiCorp Vault dynamic secrets. Automatic rotation, bounded blast radius, and audit trails. Full production guide.
SCIM Provisioning Between Authentik and Self-Hosted Apps: Tested Patterns That Actually Work
Learn SCIM provisioning with Authentik to automatically manage users across self-hosted apps. Covers architecture, working configurations, and failure modes.
HashiCorp Vault for Self-Hosters: KV, Transit, and AppRole Done Right
Learn to centralize secrets with HashiCorp Vault. Cover KV storage, Transit encryption, and AppRole machine authentication for self-hosted setups.
AES-GCM vs ChaCha20-Poly1305: How to Pick the Right Cipher Before It Picks Your Users
Compare AES-GCM vs ChaCha20-Poly1305 AEAD ciphers. Understand performance tradeoffs, hardware compatibility, and when to use each cipher for your encryption.
NSD Authoritative DNS: Zone Signing, Transfers, and a Real Ops Playbook
Set up NSD for authoritative DNS with DNSSEC signing, zone transfers, and production-ready operations. A faster, more secure alternative to BIND.
Short-Lived Certificates Done Right: Rotation, Automation, and Observability
Automate short-lived certificate rotation with Vault PKI and cert-manager. Reduce attack surface, force automation from day one, and monitor effectively.