Tag
Security and privacy, in practice
I pointed PentestCode, an open-source multi-agent pentest harness, at everything I run under zakaria.lu. The interesting part was not the 40 findings but how a coordinator, shared state and a critic killed two false HIGHs before they reached the report.
Security and privacy, in practice
For a month my Keycloak admin console was one HTTPS request from anyone. How I closed it at the Traefik edge, opened a loopback-only door over SSH, and the details that decide whether the tunnel works or locks you out.
Security and privacy, in practice
My Keycloak broker showed a username/password form beside LinkedIn even though LinkedIn was the only supported recruiter identity. Here is how I replaced that ambiguous page with a fail-closed browser flow.
I applied for verified Daybreak access, completed the identity check, and mapped the next step: connecting my own GitHub repositories to Codex Security without giving up human review or scope control.
I had Anthropic's always-on security plugin installed for a month and assumed it was reviewing every turn. Its own log said otherwise. What each layer actually does, how far its configuration goes, and the one hook that says no.
Security and privacy, in practice
A logging-only honeypot on my Hetzner box: an unprivileged user, a systemd sandbox with one non-obvious trap that silences it, and fail2ban to turn every knock into a self-expiring firewall ban.
Security and privacy, in practice
I froze the redirect Spring sends you through and read it parameter by parameter. Three lookalike strings turned out to close three different attacks, and PKCE was already on without me asking for it.
Putting a self-hosted identity server in front of LinkedIn deleted 240 lines of workaround and turned PKCE back on. It also handed out a privilege escalation — because the claim never changed, but the trust underneath it did.
Security and privacy, in practice
RFC 9116 answers the one question a stranger needs answered about your site: who do I tell about a vulnerability. What the file must contain, why the expiry date belongs in a test, and the routing trap that makes an SPA host serve it as HTML at 200.
Security and privacy, in practice
I put an MCP server on the public internet so an AI client could file todos onto my private kanban board. The interesting part wasn't the protocol — it was making the dangerous call unrepresentable.