Tag
Security and privacy, in practice
My Keycloak broker showed a username/password form beside LinkedIn even though LinkedIn was the only supported recruiter identity. Here is how I replaced that ambiguous page with a fail-closed browser flow.
I applied for verified Daybreak access, completed the identity check, and mapped the next step: connecting my own GitHub repositories to Codex Security without giving up human review or scope control.
I had Anthropic's always-on security plugin installed for a month and assumed it was reviewing every turn. Its own log said otherwise. What each layer actually does, how far its configuration goes, and the one hook that says no.
Security and privacy, in practice
A logging-only honeypot on my Hetzner box: an unprivileged user, a systemd sandbox with one non-obvious trap that silences it, and fail2ban to turn every knock into a self-expiring firewall ban.
Security and privacy, in practice
I froze the redirect Spring sends you through and read it parameter by parameter. Three lookalike strings turned out to close three different attacks, and PKCE was already on without me asking for it.
Putting a self-hosted identity server in front of LinkedIn deleted 240 lines of workaround and turned PKCE back on. It also handed out a privilege escalation — because the claim never changed, but the trust underneath it did.
Security and privacy, in practice
RFC 9116 answers the one question a stranger needs answered about your site: who do I tell about a vulnerability. What the file must contain, why the expiry date belongs in a test, and the routing trap that makes an SPA host serve it as HTML at 200.
Security and privacy, in practice
I put an MCP server on the public internet so an AI client could file todos onto my private kanban board. The interesting part wasn't the protocol — it was making the dangerous call unrepresentable.
Security and privacy, in practice
My kanban board had no authentication at all and handed its entire database to any caller. Putting it on focus.zakaria.lu meant a fourth host on the jar that was already running - plus a disclosure bug caught in review, and one cookie dot that 500'd every sign-in.
I pointed the new claude-security plugin at this very site. It spawned 82 agents, proposed 10 vulnerabilities, and then argued itself out of 9 of them. The one that survived was real — and it shipped to prod the same afternoon.