#Security
15 posts
GitHub Actions #9 Security Hardening: Minimal permissions, SHA Pinning, and pull_request_target
Starting from shrinking the GITHUB_TOKEN default permissions to read-only and opening write access only on the jobs that need it, we cover the supply chain risk of third-party actions whose tags are mutable, SHA pinning, and pairing it with Dependabot auto-updates. We also map out the pull_request_target trap — a classic route for secret exposure — and defending against the script injection that interpolated titles and branch names create.
Terraform Operations #4 Security and Cost Scanning: PR Guardrails with trivy, checkov, and Infracost
We compare and adopt trivy and checkov, static scanners that catch security misconfigurations before apply, and set a rule for handling false-positive exceptions in code with the reason attached. With Infracost commenting monthly cost changes on every PR, cost review moves to the pre-deploy stage, and default_tags-based cost tracking completes the PR guardrails.
Terraform in Practice #6 Secrets Management: SSM vs Secrets Manager and Write-Only Arguments
We compare SSM Parameter Store and Secrets Manager on cost and features to set a selection standard, then use Terraform 1.11 ephemeral resources and write-only arguments to build a configuration where the DB password appears in neither plan nor state. We also design the path where the application reads the secret at runtime, solving the plaintext problem from the last part structurally.
GitHub Foundations #8 Domain 6: Privacy, Security, and Administration — Permissions, 2FA, and Dependabot
The five repository roles, the Organization permission model, 2FA and PAT authentication, branch protection, and the boundaries between Dependabot, secret scanning, and code scanning. This post covers Domain 6 of GitHub Foundations.
Wails in Practice #5 Signing and Notarization — How a Shipped App Earns Trust
Make the finished notes app run without warnings on other people's machines. Covers why an unsigned app is blocked by macOS Gatekeeper and Windows SmartScreen, the macOS code-signing and notarization (notarytool) procedure, the types and cost of Windows code-signing certificates, and what to know before handing this process to CI.
Committed a Secret to Git? Rotate the Key First, Then Clean History with filter-repo
A response procedure for the incident where an AWS key, an API token, or a .env file was committed and pushed. Priority one is not cleaning history but invalidating the key. We also cover rewriting history with filter-repo and the prevention tooling.
Django Advanced #7: Deployment security — settings split, ALLOWED_HOSTS, CSRF, secret management
Settings split patterns, django-environ, DEBUG/ALLOWED_HOSTS/CSRF/HSTS, SECRET_KEY management, and manage.py check --deploy — what to verify before putting Django into production.
AWS Advanced #6: Secrets Manager / Parameter Store
How Secrets Manager and SSM Parameter Store differ, automatic rotation, fetching from code (boto3 / caching / Powertools), ECS and Lambda integration, IaC wiring, cost comparison — AWS secret / configuration management.
RHEL Advanced #5: Security Hardening — auditd, OpenSCAP, FIPS
The three pillars of operational security stacked on top of SELinux. auditd for recording every change to the system with ausearch/aureport, OpenSCAP for automated checking and remediation against CIS, STIG, PCI-DSS, and FIPS mode required by government and financial certifications — all in one cycle.
RHEL Advanced #4: SELinux Advanced — Writing Policy and audit2allow
Going one level higher than the intermediate post: the structure of .te/.fc/.if policy files, the flow and limits of generating modules with audit2allow, the procedure to compile and install with checkmodule / semodule_package / semodule by hand, plus booleans and interfaces — all in one cycle. The goal is to follow an AVC denial all the way through to a permanent policy module.
Docker Advanced #3: Image Security — non-root, distroless, Trivy Scans
A practical toolkit for container security. Dropping to a non-root USER, read-only root with tmpfs, dropping capabilities, narrowing the attack surface with distroless, scanning known CVEs with Trivy/Grype, and linting Dockerfiles with hadolint.
AWS Basics #6: Security Basics — MFA, Key Rotation, Least Privilege
Enforcing MFA on root and IAM users, automating access-key rotation, auditing permissions with IAM Access Analyzer, least-privilege patterns, and the incidents you actually see in production.