Archives
All the articles I've archived.
- #Lineth L2 Lifecycle#Ethereum#Layer 2
Lineth L2 Transaction Lifecycle (6) - Following an L2 Message to a Successful Claim on L1
The transaction from block 23,851 sent 0.02 ETH from L2 to L1 through the message service. I followed its message hash from the MessageSent event, through the postman, to the MessageClaimed event and a successful claim receipt on L1 six minutes later.
4 min read - #Lineth L2 Lifecycle#Ethereum#Layer 2
Lineth L2 Transaction Lifecycle (5) - Web3Signer: Transaction Signing, HTTPS, and L1 Sender Verification
Where the Coordinator's L1 transactions get signed. What Web3Signer signs, how the Coordinator reaches it over mutual TLS, and a check that the public keys in the config derive to the exact senders in the blob and aggregation receipts.
5 min read - #Lineth L2 Lifecycle#Ethereum#Layer 2
Lineth L2 Transaction Lifecycle (4) - Following an L2 Blob from Creation to Finalization on L1
One 80-block L2 range in my Lineth lab, from the Coordinator closing its blob, through the compression proof and the EIP-4844 blob transaction, to the DataFinalizedV3 event on the L1 rollup contract. Coordinator logs, cast receipts, and contract events, connected by range and hash.
5 min read - #Lineth L2 Lifecycle#Ethereum#Layer 2
Lineth L2 Transaction Lifecycle (3) - Inside the Prover: From a Coordinator Request to a Proof Response
What happens between the Coordinator writing a proof request and reading the result. I followed L2 blocks 26,605 to 26,684 through shared-storage request files, the prover controller, trace reading, module utilization, and the execution, compression, and aggregation responses in my Lineth lab.
6 min read - #Lineth L2 Lifecycle#Ethereum#Layer 2
Lineth L2 Transaction Lifecycle (2) - From L2 Blocks to Execution Proofs: Trace and Conflation in the Coordinator
How the Coordinator turns L2 blocks into proof work. I followed blocks 24,205 to 24,284 in my Lineth lab: an 80-block batch closed by a trace limit, a one-batch blob, an execution-proof request, and its result 3 minutes 24 seconds later.
4 min read - #Lineth L2 Lifecycle#Ethereum#Layer 2
Lineth L2 Transaction Lifecycle (1) - Following an L2 Transaction Through Besu and Maru
A transaction that is accepted, one that is included in a block, and one an RPC node can serve are three separate events. I followed L2 block 23,851 in my Lineth lab from the sequencer's payload, through the RPC node's import and head update, to a successful receipt, using only Kubernetes logs and JSON-RPC.
5 min read - #Lineth L2 Lifecycle#Ethereum#Layer 2
Lineth L2 Transaction Lifecycle (0) - The Lab Architecture
A map of the local Lineth rollup before the series opens it up: RPC Besu, the sequencer and Maru for execution, the Coordinator and Prover for proving, Web3Signer for signing, the rollup contract for settlement, and the postman for message delivery, with the evidence each one leaves.
5 min read - #SRE#Kubernetes#Observability
Lineth L2 Homelab - A Full Rollup on One Kubernetes Node, and How I Watch It
A tour of my SRE homelab: a local proof-of-stake L1 and a complete zk-rollup L2 running as 60+ pods on a single kind node on a Mac, deployed by Flux, and monitored with Prometheus, Loki, Tempo, SLOs and 26 Grafana dashboards. Screenshots taken from the live lab.
12 min read - #Contribution#Ethereum#Layer 2
Lineth Postman: A Stuck Claim That Could Never Be Cancelled
Lineth's postman cancels a stuck claim transaction by bumping its stored fees by 10%. Postgres returned those fees as strings, so the bump threw "Cannot mix BigInt and other types" and the cancel never ran. One nonce gap held up every later claim. A two-line fix in the entity mapper.
5 min read - #SRE Postmortem#SRE#Postmortem
Lineth L2 Incident Management: Postmortem (5) - An L1 Deadlock the Engine API Made Permanent
The lab's local L1 stopped producing blocks for 3 h 14 min: after a one-slot re-org, the beacon node asked the execution client to build on a block's parent, and the Engine API says it must not. Settlement stopped behind it and the coordinator wedged. A Google SRE format postmortem with the logs, the one-RPC fix, and an SLI that hid the worst withdrawals.
9 min read - #SRE Postmortem#SRE#Postmortem
Lineth L2 Incident Management: Postmortem (4) - Alive but Dead: 12 Hours Without Grafana
A supervised kubectl port-forward lost its stream during a node memory stall and logged the same error 1,929 times over 12 hours. The process stayed alive, so its supervisor never restarted it. A Google SRE format postmortem on monitoring the monitoring, with the logs and a fix tested by injecting the failure.
5 min read - #SRE Postmortem#SRE#Postmortem
Lineth L2 Incident Management: Postmortem (3) - Started Before DNS: An RPC Node With No Peer for 49 Minutes
After a planned restart, the L2's public RPC node came up a few seconds before cluster DNS, failed to resolve its only peer once, and never tried again. It looked healthy for 49 minutes while no user transaction reached the sequencer. A Google SRE format postmortem with the logs and a one-probe fix.
7 min read - #SRE Postmortem#SRE#Postmortem
Lineth L2 Incident Management: Postmortem (2) - Two Counters, One Limit: Every Batch Proven Twice
Settlement fell 1,087 blocks behind. Every batch had been failing the prover's normal mode for days because the coordinator and the prover counted the same trace module differently, and the Mac under the cluster was swapping the prover's memory. A Google SRE format postmortem with the logs and the arithmetic.
9 min read - #SRE Postmortem#SRE#Postmortem
Lineth L2 Incident Management: Postmortem (1) - A BigInt Bug That Broke the Bridge's Self-Repair
Deposits from L1 to L2 went unclaimed for 1 h 46 min. The postman had a repair path for exactly this failure, and it crashed 1,125 times on a string that should have been a bigint. A blameless postmortem in the Google SRE format, with the logs, the fix, and the upstream PR.
9 min read - #Contribution#lnd#Lightning Network
LND: Short Reads in NodeAnnouncement2 Address Decoders, Fixed
I reported that LND's NodeAnnouncement2 address decoders accepted truncated records by ignoring how many bytes Read returned. A maintainer confirmed it, found a second bug in the same parser, and fixed both in lnd#11219 with me as a co-author.
4 min read - #Contribution#x402#Python
x402: A skipHandler That Skipped the Payment Too
In x402's TypeScript, Python, and Go servers, a request whose hook returned skipHandler bypassed the before-handler settle. On upfront it returned 200 with no settlement; on escrow it broke capture. A PR that moves the skip after that settle, checked against real escrow programs on forked chains.
5 min read - #Contribution#Python#x402
x402: A V1 Payment Header That Crashed the Python Server
In the x402 Python SDK, the V2-only HTTP resource server passed a decoded V1 payment payload on to requirement matching, which read a field V1 doesn't have and returned 500. A PR that rejects V1 payloads before matching, so the client gets a 402.
3 min read - #Contribution#Python#CI/CD
web3-utils: A Version Gate That Couldn't Read Prereleases
stakefish/web3-utils.py's CI version gate compared versions by keeping only their numeric parts, so beta and rc numbers turned into patch numbers. It rejected valid promotions and let a downgrade through. A PR that switches to packaging.version.
3 min read - #Contribution#Python#Ethereum
web3-utils: An RPC Retry That web3 7 Quietly Broke
In stakefish/web3-utils.py, RPC timeout retries checked for ValueError, but web3 7 raises Web3RPCError. Reproducing it by mocking at the provider, then a review that showed the fix would also retry transaction submission, and the allowlist that followed.
Updated:8 min read - #Contribution#Ethereum#Validator
eth2-monitor: An Epoch Replay That Never Finishes
In stakefish/eth2-monitor, --replay-epoch ran under the same supervisor as live monitoring, so a finished replay was restarted as if it had crashed. A PR that tells completion apart from interruption.
3 min read - #Contribution#CI/CD#GitHub Actions
eth2-monitor: Release Binaries That Overwrite Each Other
stakefish/eth2-monitor's release workflow builds eight OS and architecture combinations into two file names, so only the Windows builds survive. An issue asking which platforms the release is meant to ship.
2 min read - #Security Requirements Plugin#Security Requirements#Security Design
Deriving Security Requirements for a Lightning-Paid Scan Service
Running my security-requirements plugin on the OpenCTI paid scan service: a confirmed profile, a FIPS 199 impact, eleven service-specific threats, a confirmed risk batch, and nineteen verifiable requirements, three of which no baseline control would have produced.
7 min read - #Lightning Network#lnd#Prometheus
An Always-On Testnet4 LND Node (2) - Moving the Monitoring to Testnet4
Pointing the lndmon, Prometheus, and Grafana stack from the regtest lab at the always-on testnet4 node: a new lndmon service, a relabeled scrape job, and lndmon's own seven Grafana dashboards, adjusted and provisioned read-only.
11 min read - #Lightning Network#lnd#Bitcoin
An Always-On Testnet4 LND Node (1) - bitcoind and LND on Testnet4
Moving the systemd-managed LND lab from regtest to Bitcoin's testnet4 as a node that stays up: a separate pruned bitcoind and a separate LND, each with its own account, directories, ports, and rpcauth login, and LND's first look at a backend still syncing.
17 min read - #Lightning Network#lnd#Prometheus
Monitoring LND with systemd, Without Containers (3) - Dashboards with Grafana
Binding Grafana to loopback, checking its health, connecting it to Prometheus, and building the first dashboard panels for the two regtest LND nodes: channel balance, scrape status, peers, and active channels.
11 min read - #Lightning Network#lnd#Prometheus
Monitoring LND with systemd, Without Containers (2) - Scraping lndmon with Prometheus
Installing Prometheus from Ubuntu's archive, reading the unit and hardening the package ships, binding it to loopback, replacing the sample config with scrape jobs for both lndmon exporters, and checking every target is up.
8 min read - #Lightning Network#lnd#Prometheus
Monitoring LND with systemd, Without Containers (1) - Exporting LND Metrics with lndmon
Building lndmon from source, connecting it to two regtest LND nodes over TLS with read-only macaroons, and running one exporter per node under systemd, the first step toward a monitored baseline.
12 min read - #Lightning Network#lnd#Bitcoin
Running LND with systemd, Without Containers (7) - Opening a Channel and Sending a Payment
Opening a regtest channel from the funded node to its peer, following the funding transaction through the mempool into a block, and sending a 10,000-sat Lightning payment across it.
10 min read - #Lightning Network#lnd#Bitcoin
Running LND with systemd, Without Containers (6) - Configuring LND and Running It as a Service
Writing lnd.conf against the regtest bitcoind, running LND under systemd, creating its wallet, proving the RPC and ZMQ paths, funding it with 1 BTC, and connecting a second node as a peer.
19 min read - #Lightning Network#lnd#Bitcoin
Running LND with systemd, Without Containers (5) - Preparing bitcoind for LND: rpcauth and ZMQ
Giving LND its own RPC login to bitcoind with rpcauth, comparing it with cookie auth, proving the login works as the lnd user, and adding the ZMQ block and transaction feeds LND needs.
9 min read - #Lightning Network#lnd#Linux
Running LND with systemd, Without Containers (4) - Installing LND and Its Service Account
Downloading LND v0.21.3-beta for ARM64, verifying the release manifest against a maintainer's signing key and the tarball against the manifest, installing it next to bitcoind, and giving it its own service user and directories.
4 min read - #Lightning Network#lnd#Bitcoin
Running LND with systemd, Without Containers (3) - Running bitcoind as a systemd Service
A hardened systemd unit for bitcoind, checked step by step: verify, start, status, RPC, a regtest miner wallet with 101 blocks, a restart that keeps the chain and wallet, and enabling it at boot.
11 min read - #Lightning Network#lnd#Bitcoin
Running LND with systemd, Without Containers (2) - Installing and Configuring Bitcoin Core
Picking the Bitcoin Core version LND is tested against, verifying the download by checksum and builder signatures, installing it, and giving bitcoind its own service user, directories, and locked-down configuration.
11 min read - #Lightning Network#lnd#Linux
Running LND with systemd, Without Containers (1) - The Lab Environment
A home lab that runs LND and an Ethereum Hoodi node directly in a Lima VM on a Mac, without Docker or Kubernetes, to learn what those tools were doing for me. Part 1 covers the host, VM, guest kernel, and service manager, and checks that the VM starts clean.
6 min read
- #AI#Kagent#SRE
Diagnosing OpenCTI with Kagent (6) - Drill 2: Invoice Failure After the SRE Upgrades
A blind rehearsal drill against the upgraded L402 monitoring. The pages fired in 2 minutes 21 seconds and the agent found the broken component, but it skipped a required tool and invented details. A blameless review of what happened.
12 min read - #AI#Kagent#Kubernetes
Diagnosing OpenCTI with Kagent (5) - Reviewing the Setup Against Google SRE
I reviewed the L402 payment gate's monitoring and on-call agent against the Google SRE Book and Workbook. Eight practices, what the review found, what changed, and the gaps that are still open.
9 min read - #Lightning Network#lnd#Routing
Relaying a Test Payment Through a Testnet LND Node
Using two testnet LND nodes on a Mac and in WSL, a 10-sat self-payment is routed through the WSL node, after finding and fixing a disabled channel policy, and checked against the node's forwarding history.
15 min read - #Lightning Network#lnd#Routing
Checking Routing Readiness on a Testnet LND Node
Before changing any fee policy, a read-only check of a testnet LND node on Kubernetes in WSL covering pod state, chain and graph sync, channel liquidity by direction, SCIDs, and per-channel fee and HTLC policies.
8 min read - #AI#Kubernetes#Aperture
Diagnosing OpenCTI with Kagent (4) - Rehearsing Incidents with an LLM Agent
I rehearsed incidents against a Kagent on-call agent watching an Aperture L402 payment gate, then scored it against a playbook. The exercise found gaps in my own alerts too.
8 min read - #AI#Kagent#Kubernetes
Diagnosing OpenCTI with Kagent (3) - Designing Access Control in a GitOps Setup
Access control for kagent has two sides, who can change an agent and what a running agent can reach. How I split them across Git review, GitOps, RBAC, MCP, application, and database controls.
16 min read - #AI#Kagent#Kubernetes
Diagnosing OpenCTI with Kagent (2) - Tools, Code-First Diagnosis, and Read-Only Access
The four MCP tools behind the paid-service diagnosis agent, why the code classifies the state before the model explains it, and how Kubernetes access stays read-only.
5 min read - #AI#Kagent#Kubernetes
Diagnosing OpenCTI with Kagent (1) - Architecture: Agent, Model, and MCP Server
How I built a diagnosis agent for a paid OpenCTI and ASM service on kagent, and how the Helm values, Agent, ModelConfig, system prompt, and MCP server fit together.
5 min read - #Lightning Network#lnd#L402
Lightning Payments for OpenCTI (3) - From Lightning Payment to a Paid Scan Order
How a paid Lightning invoice becomes a paid scan order, from the preimage and L402 proof to merchant settlement checks, durable receipt processing, and safe retries.
6 min read - #Lightning Network#lnd#L402
Lightning Payments for OpenCTI (2) - From a Scan Order to a Lightning Invoice
How our OpenCTI and ASM service turns a scan order into a Lightning invoice, from the server-side quote to Aperture's dynamic price lookup and the L402 challenge.
4 min read - #Lightning Network#lnd#L402
Lightning Payments for OpenCTI (1) - Aperture as a Payment Gate
How Aperture's L402 payment gate works, from a simple paid API to our OpenCTI and ASM service with order-based pricing and receipt verification, and where Aperture's job ends.
5 min read - #Kagent#Prometheus#Kubernetes
Prometheus Alert Rules: Helm Values or PrometheusRule Files?
Where Prometheus alerts come from in kube-prometheus-stack, and why I keep the install in Helm values but each service's alerts in its own PrometheusRule file.
3 min read - #Kagent#LND on Kubernetes#Prometheus
Metrics Collector: Prometheus on LND
Before an incident-response drill, the node needs metrics. How lndmon turns LND's state into Prometheus metrics, and how to read the /metrics format by hand.
3 min read - #LND on Kubernetes#Lightning Network#Kubernetes
Running an LND Lightning Node on Local Kubernetes: Designing for State, Identity, and Recovery
A Lightning node is state, not just a process. How I mapped LND's wallet, channel, and recovery model onto StatefulSets, PVCs, NetworkPolicy, and tests on local K3s.
13 min read - #Study
How Do I Contribute to Open Source, and Why Do I Do It?
How I get to know an unfamiliar open-source project, and why I contribute. Open source taught me a lot, and I want other people to learn alongside me.
3 min read - #Study
What Shouldn't I Miss in the AI Era?
New models and tools arrive every day. The one thing I don't want to hand over to AI is my own understanding, and the responsibility that comes with it.
2 min read - #Lightning Network#lnd#Aperture
Introduction to Lightning Node Operations
Payment channels, HTLCs, directional liquidity, and where LND and Aperture fit, as the groundwork for operating a Lightning node.
8 min read - #Contribution#Fuzzing#Gosentry
Reporting a Silent Fuzzer Death in Trail of Bits' gosentry
A gosentry/LibAFL bug where the fuzzer could crash and stop making progress while go test -fuzz still reported success, plus the fix.
2 min read - #Lightning Network#lnd#Aperture
Aperture L402 Security Event Monitoring Proposal
A proposal to replace Aperture's DEBUG-only L402 logs with structured, HMAC-referenced security events, with real before/after captures for each failure type.
6 min read - #Lightning Network#lnd#Aperture
Aperture #286: L402 Metrics Before and After
Adding per-outcome Prometheus counters to Lightning Labs' Aperture proxy for L402 minting and verification, and what changes for an operator watching the /metrics endpoint.
Updated:18 min read - #OSCAL#Policy as Code#Compliance
Converting the Web3 Key Management Policy to OSCAL
How a Markdown key management policy becomes a machine-readable OSCAL Catalog: the mapping rules, the JSON shape, schema validation, and what's left unmapped.
4 min read - #Key Management#Vault#Hoodi
Where the Web3 Key Management Policy Is Already Implemented in My Hoodi Validator
Mapping specific clauses of the Web3 Cryptographic Key Management Policy against the Vault-based secret design already running in my Hoodi validator, and being honest about the gaps.
5 min read - #Key Management#Validator#Hoodi
Validator Key Types and Key Management Policy for a Hoodi Validator
The key types, classification model, and Web3-specific principles from the Web3 Cryptographic Key Management Policy that apply directly to a node validator.
5 min read - #NIST#NIST SP 800-57#NIST SP 800-131A
NIST SP 800-57 and SP 800-131A in the Web3 Key Management Policy
How the Web3 Cryptographic Key Management Policy uses NIST SP 800-57 Part 1 and SP 800-131A, and why clause-level mapping is still open work.
3 min read - #Pipeline Controls#CI/CD#CI/CD Security
CI/CD Security Controls and Implementation in the Pipeline Design
A technical overview of the CI/CD security controls implemented across the pipeline design, from token permissions to release signing, paired with concrete threat-mapped implementation detail.
12 min read - #Hoodi#Validator#DevSecOps
Prioritizing Security Controls: What Happened and What I Learned
Lessons from building a Hoodi validator on AWS about deployment speed, infrastructure cost, operational burden, and over-relying on AI when applying DevSecOps controls.
5 min read - #Blockchain#Hoodi#Validator
Hoodi Validator Use Cases and Data Flows
How Hoodi execution, consensus, validation, signing, and observability components exchange data in a Kubernetes-based validator platform.
3 min read - #Pipeline Controls#Private Repository#DevSecOps
Private Repositories Security Review Process
A practical process for reviewing, approving, and continuously reassessing third-party artifacts before internal use.
4 min read - #Hoodi#Validator#AWS
Audit and Logging Architecture for Hoodi Node Validator
How the Hoodi validator platform collects, protects, archives, and investigates AWS, Kubernetes, Vault, and validator evidence.
19 min read - #Vault#Kubernetes#Hoodi
cert-manager and Vault: Roles, Scope, and Collaboration
How cert-manager, Vault, Kubernetes, and AWS KMS work together to protect Vault transport, workload identity, and validator secrets.
15 min read - #Hoodi#Validator#AWS
Hoodi Node Validator AWS Infrastructure Overview
An overview of the private AWS infrastructure supporting Hoodi execution and consensus workloads on Amazon EKS.
8 min read - #Vault#Identity Management#Kubernetes
Identity Management Using Vault
How Vault, Kubernetes, AWS, and GitHub divide responsibility for workload, operator, and release identities.
7 min read - #Kubernetes#EKS#Hoodi
Kubernetes Namespace Design for a Hoodi Validator
A security-focused guide to designing Kubernetes namespace boundaries for a Hoodi validator architecture.
6 min read - #Vault#Kubernetes#EKS
Vault Architecture on Kubernetes
A practical guide to Vault architecture, workload identity, secret delivery, PKI, and operations on Kubernetes.
8 min read - #Vault#Ethereum#Hoodi
Vault Secret Management for Hoodi Validator
How Vault Agent delivers validator secrets for Engine API authentication, TLS, signing, and slashing protection.
8 min read - #AWS#ECR#EKS
Private ECR Delivery Architecture for Private EKS
A defense-in-depth design for delivering approved private ECR artifacts to private EKS workloads.
Updated:15 min read - #AWS#EKS#Kubernetes
EKS Security Controls Implemented in the Cluster Design
A technical overview of EKS security controls implemented across the cluster design.
8 min read - #Ethereum#Hoodi#AWS
Private EKS Security Design Review
A confidentiality-focused security design review of a private EKS environment.
10 min read - #Azure#Backup#Recovery
Adding an Azure Recovery Vault Protected Items Check to Prowler
How Prowler identifies Azure Recovery Services Vaults with no protected backup items.
2 min read - #Azure#Backup#Recovery
Adding an Azure Recovery Vault Retention Check to Prowler
How Prowler identifies Recovery Services Vault backup policies with insufficient retention.
2 min read - #Azure#PostgreSQL#Prowler
Adding an Azure PostgreSQL High Availability Check to Prowler
How Prowler identifies Azure Database for PostgreSQL Flexible Servers without enabled high availability.
2 min read - #Azure#PostgreSQL#Prowler
Adding an Azure PostgreSQL Geo-Redundant Backup Check to Prowler
How Prowler verifies that Azure Database for PostgreSQL Flexible Server backups are geo-redundant.
1 min read - #Azure#NetworkSecurity#DDoS
Adding an Azure VNet DDoS Protection Check to Prowler
How Prowler verifies that Azure virtual networks use DDoS Network Protection.
2 min read - #Azure#NetworkSecurity#NSG
Adding an Azure Subnet NSG Check to Prowler
How Prowler detects Azure virtual-network subnets that lack Network Security Group protection.
2 min read - #Azure#MySQL#Prowler
Adding an Azure MySQL High Availability Check to Prowler
How Prowler identifies Azure Database for MySQL Flexible Servers without failover-ready high availability.
2 min read - #Azure#MySQL#Prowler
Adding an Azure MySQL Geo-Redundant Backup Check to Prowler
How Prowler verifies that Azure Database for MySQL Flexible Server backups can survive a regional outage.
2 min read - #Azure#EntraID#Identity
Adding an Azure Entra Recent Sign-In Check to Prowler
How Prowler identifies enabled Microsoft Entra accounts that have not signed in within 90 days.
2 min read - #Azure#EntraID#Identity
Adding an Azure Entra Strong Authentication Check to Prowler
How Prowler verifies that Microsoft Entra tenants enable strong authentication methods and MFA registration enforcement.
2 min read - #Azure#EntraID#Identity
Adding an Azure Entra App Credential Expiry Check to Prowler
How Prowler identifies expired, soon-to-expire, and non-expiring credentials on Microsoft Entra app registrations.
2 min read - #Azure#MicrosoftDefender#Prowler
Adding an Azure Defender CSPM Check to Prowler
How Prowler verifies that Microsoft Defender Cloud Security Posture Management is enabled for an Azure subscription.
2 min read - #Azure#Databricks#Prowler
Adding an Azure Databricks No Public IP Check to Prowler
How Prowler verifies that Azure Databricks classic-compute workspaces use secure cluster connectivity.
2 min read - #Azure#Databricks#Prowler
Adding an Azure Databricks Public Network Access Check to Prowler
How Prowler identifies Azure Databricks workspaces that remain accessible through public network endpoints.
2 min read - #Azure#CosmosDB#Prowler
Adding an Azure Cosmos DB Public Network Access Check to Prowler
How Prowler identifies Cosmos DB accounts that remain reachable through public network endpoints.
2 min read - #Azure#CosmosDB#Prowler
Adding an Azure Cosmos DB Minimum TLS Check to Prowler
How Prowler identifies Cosmos DB accounts that still permit legacy TLS protocols for client connections.
2 min read - #Azure#CosmosDB#Prowler
Adding an Azure Cosmos DB Continuous Backup Check to Prowler
How Prowler identifies Cosmos DB accounts that lack continuous backup and point-in-time restore capability.
2 min read - #Azure#CosmosDB#Prowler
Adding an Azure Cosmos DB Automatic Failover Check to Prowler
How Prowler identifies Cosmos DB accounts that require manual intervention during a regional outage.
2 min read - #Azure#AKS#Kubernetes
Adding an Azure AKS Local Accounts Check to Prowler
How Prowler identifies AKS clusters that still allow local Kubernetes accounts to bypass Microsoft Entra ID authentication.
3 min read - #Azure#AKS#Kubernetes
Adding an Azure AKS Monitor Check to Prowler
How Prowler identifies AKS clusters without Azure Monitor managed Prometheus metrics enabled.
3 min read - #Azure#AKS#Kubernetes
Adding an Azure AKS Defender Check to Prowler
How Prowler identifies AKS clusters without Microsoft Defender for Containers security monitoring enabled.
3 min read - #Azure#AKS#Kubernetes
Adding an Azure AKS Auto-Upgrade Check to Prowler
How Prowler identifies AKS clusters without an automatic Kubernetes upgrade channel and helps prevent version drift.
3 min read - #GCP#Prowler#Contribution
Adding a GCP Secret Manager Rotation Check to Prowler
How Prowler verifies that Secret Manager secrets have automatic rotation configured within policy and have not missed their next rotation date.
3 min read - #GCP#Prowler#Contribution
Adding a GCP Secret Manager Public Access Check to Prowler
How Prowler identifies Secret Manager secrets whose IAM policies grant access to everyone or to every Google-authenticated user.
3 min read - #GCP#Prowler#Contribution
Adding a GCP Cloud SQL High Availability Check to Prowler
How Prowler identifies Cloud SQL primary instances that lack regional high availability and automatic zonal failover.
3 min read - #GCP#Prowler#Contribution
Adding a GCP Cloud SQL CMEK Check to Prowler
How Prowler identifies Cloud SQL instances that use Google-managed encryption keys instead of customer-managed keys in Cloud KMS.
4 min read - #GCP#Prowler#Contribution
Adding a GCP Cloud Functions Public Access Check to Prowler
How Prowler detects Cloud Functions that IAM policies make invokable by anyone on the internet or by any Google-authenticated user.
3 min read - #GCP#Prowler#Contribution
Adding a GCP Cloud Functions VPC Check to Prowler
How Prowler's new Cloud Functions VPC connector check helps find missing private-network boundaries in GCP serverless workloads.
3 min read - #Contribution#Supply Chain Security#NIST SP 800-204
Private Registries and Package Mirrors: What I Contributed to the SEAL Security Frameworks
A new SEAL Security Frameworks page on internal package registries - what mirroring defends against, how routing blocks dependency confusion, and why the registry becomes a trust component in its own right.
11 min read - #Contribution#CI/CD Security#Supply Chain Security
Policy as Code Through the CI/CD Pipeline: What I Contributed to the SEAL Security Frameworks
A four-page section on policy as code across the CI/CD pipeline, mapped to NIST SP 800-204D, merged into the SEAL Security Frameworks.
11 min read
- #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (10) - Regulatory Overlays
Applying PIPA/ISMS-P and customer contractual obligations on top of the EKS SaaS baseline, and why tenant deletion is a control-plane workflow, not a single DynamoDB delete.
3 min read - #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (9) - CI/CD Verification
Gating EKS SaaS deployments on requirement IDs, from rendering Helm and Kustomize manifests to running tenant-boundary tests across Cognito pools.
3 min read - #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (8) - Evidence and Review
Why an EKS SaaS requirement is a criterion rather than proof, and how the plugin ties NetworkPolicy, IRSA, and tenant-context requirements to evidence-based status.
2 min read - #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (7) - Refresh and Lifecycle
Refreshing the EKS SaaS security contract as ingress, cluster topology, and IAM bindings change, without losing prior approvals, evidence, or requirement history.
3 min read - #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (6) - Authoring, Validation, and Publication
Writing atomic, verifiable EKS SaaS requirements for tenant identity, network isolation, IRSA, and the provisioning pipeline, validated by code before publication.
5 min read - #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (5) - Responsibility and Prioritization
Splitting EKS SaaS work across AWS, the platform team, product teams, and the SaaS operator, and why IRSA and shared controllers need more than one owner.
6 min read - #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (4) - Blast Radius
Calculating blast radius across the AWS EKS SaaS reference architecture, from a contained siloed order table to a provisioning pipeline that can reach the whole account.
5 min read - #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (3) - Threat Analysis
A ten-threat model across the AWS EKS SaaS reference architecture's shared control plane, tenant namespaces, ingress routing, and IAM Roles for Service Accounts.
8 min read - #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (2) - CIA Impact and Baseline
Calculating CIA impact for the AWS EKS SaaS reference architecture, where pooled and siloed DynamoDB models and a shared control plane both feed the result.
7 min read - #Security Design#EKS SaaS#Security Requirements
Security Design Review: AWS EKS SaaS (1) - Service Analysis
Building a confirmed service profile for AWS's EKS SaaS reference architecture, where namespace-per-tenant isolation and a shared control plane change what counts as a boundary.
6 min read - #Security Design#ECS SaaS#Security Requirements
Security Design Review: AWS ECS SaaS (10) - Regulatory Overlays
Applying PIPA/ISMS-P and customer contractual obligations on top of the ECS SaaS baseline, and why tenant deletion and cross-border data flow stay explicit review items.
5 min read - #Security Design#ECS SaaS#Security Requirements
Security Design Review: AWS ECS SaaS (9) - CI/CD Verification
Five deterministic gates that connect ECS SaaS requirements to CI/CD, from validating the requirement contract to tenant-boundary tests and image provenance.
6 min read - #Security Design#ECS SaaS#Security Requirements
Security Design Review: AWS ECS SaaS (8) - Evidence and Review
Why an ECS SaaS requirement is a criterion rather than proof, and how the plugin ties tenant-isolation, IAM, and audit requirements to evidence-based status.
5 min read - #Security Design#ECS SaaS#Security Requirements
Security Design Review: AWS ECS SaaS (7) - Refresh and Lifecycle
Refreshing the ECS SaaS security contract as isolation tiers, tenant data, and integrations change, without losing approvals, evidence, or requirement history.
5 min read - #Security Design#ECS SaaS#Security Requirements
Security Design Review: AWS ECS SaaS (6) - Authoring, Validation, and Publication
Turning the ECS SaaS work queue into atomic, verifiable requirements, validated by code and published as a versioned security contract.
6 min read - #Security Design#ECS SaaS#Security Requirements
Security Design Review: AWS ECS SaaS (5) - Responsibility and Prioritization
Turning the ECS SaaS baseline, threats, and blast-radius results into an owned, prioritized work queue, with the control plane and tenant isolation tier driving priority.
6 min read - #Security Requirements Plugin#Security Design#Security Requirements
Security Requirements Plugin - Kubernetes Analysis Added
Turning Kubernetes manifests into a security graph so RBAC, NetworkPolicy, service mesh, and cloud IAM relationships feed blast-radius and requirements analysis.
9 min read - #Security Design#ECS SaaS#Security Requirements
Security Design Review: AWS ECS SaaS (4) - Blast Radius
Calculating blast radius for the AWS ECS SaaS reference architecture, tracing which tenants, data, and control-plane components a threat path could reach.
5 min read - #Security Design#ECS SaaS#Security Requirements
Security Design Review: AWS ECS SaaS (3) - Threat Analysis
A STRIDE threat model across nine trust boundaries of the AWS ECS SaaS reference architecture, from tenant claim spoofing to a deployment role that can reach every tenant.
8 min read - #Security Design#ECS SaaS#Security Requirements
Security Design Review: AWS ECS SaaS (2) - CIA Impact and Baseline
Calculating confidentiality, integrity, and availability impact for the AWS ECS SaaS reference architecture, and why holding customer data pulls in a privacy baseline and a regulatory overlay.
7 min read - #Security Design#ECS SaaS#Security Requirements
Security Design Review: AWS ECS SaaS (1) - Service Analysis
Building a confirmed service profile for AWS's ECS SaaS reference architecture, before any control, threat, or blast-radius calculation.
9 min read - #Security Requirements Plugin#Security Design#Security Requirements
Security Requirements Plugin: New Feature - Blast Radius
How the security-requirements plugin's blast-radius stage scopes each threat across tenant, data, runtime, control, and recovery dimensions to prioritize requirements and review work.
3 min read - #Security Design#Serverless#Security Requirements
Security Design Review: AWS Serverless Movie Voting App (9) - CI/CD Verification
Turning each requirement's verification metadata into a dispatchable CI/CD check, from IAM policy inspection to sentinel-based log scanning.
5 min read - #Security Design#Serverless#Security Requirements
Security Design Review: AWS Serverless Movie Voting App (8) - Regulatory Overlays
Applying ISMS-P and GDPR overlays on top of the NIST baseline once the movie service adds accounts, an analytics provider, and Korean and EU users.
5 min read - #Security Design#Serverless#Security Requirements
Security Design Review: AWS Serverless Movie Voting App (7) - Evidence and Review
Why a written security requirement is a criterion, not proof, and how the security-requirements plugin ties each requirement to evidence-based status.
5 min read - #Security Design#Serverless#Security Requirements
Security Design Review: AWS Serverless Movie Voting App (6) - Refresh and Lifecycle
How the security-requirements plugin re-derives a security contract as a service changes, without losing prior approvals, exceptions, or audit history.
8 min read - #Security Design#Serverless#Security Requirements
Security Design Review: AWS Serverless Movie Voting App (5) - Requirement Authoring and Validation
Turning a prioritized work list into stable, atomic, verifiable security requirements, then linting and merging them into a publishable contract.
8 min read - #Security Design#Serverless#Security Requirements
Security Design Review: AWS Serverless Movie Voting App (4) - Responsibility and Prioritization
Assigning AWS/team/org responsibility for the selected controls and crossing them with the eight movie-service threats to produce a prioritized work list.
11 min read - #Security Design#Serverless#Security Requirements
Security Design Review: AWS Serverless Movie Voting App (3) - Threat Analysis
Applying STRIDE at each trust boundary of the AWS serverless movie-rating sample, turning eight threats into eight testable security requirements.
8 min read - #Security Design#Serverless#Security Requirements
Security Design Review: AWS Serverless Movie Voting App (2) - CIA Impact and Baseline
How the security-requirements plugin turns a confirmed service profile into a CIA impact rating, a NIST 800-53B baseline, and an ASVS level.
15 min read - #Security Design#Serverless#Security Requirements
Security Design Review: AWS Serverless Movie Voting App (1) - Service Analysis
How the security-requirements plugin builds a confirmed service profile from an AWS serverless movie-rating sample, before any control or threat is derived.
13 min read - #AI#AI Supply Chain#Supply Chain Security
The AI Software Supply Chain Is Under Attack
A field guide to AI-era supply chain attacks - the objects at risk, how to screen them, and why AI coding raises the stakes.
11 min read - #Security Requirements Plugin#Security Design#Security Requirements
Security Requirements Plugin: First Security Activity
Claude plugin that derives security requirements from service descriptions and reviews security design.
10 min read
- #Pipeline Controls#NIST SP 800-204D#CI/CD
Securing Workflows in CD Pipelines
Supply chain security measures also apply to controls during the CD process.
4 min read - #Pipeline Controls#NIST SP 800-204D#CI/CD
Securing Workflows in CI Pipelines - Secure Code Commits
Appropriate forms of testing should be performed before code commits
2 min read - #NIST SP 800-204D#CI/CD#CI/CD Security
Securing Workflows in CI Pipelines - Integrity of Evidence Generation During Software Updates
How to ensure the integrity of evidence generation during software updates
6 min read - #NIST SP 800-204D#CI/CD#CI/CD Security
Securing Workflows in CI Pipelines - Secure Pull-Push Operations on Repositories
Deep dive into secure Pull-Push Operations on Repositories referring to NIST SP 800-204D
6 min read - #Pipeline Controls#NIST SP 800-204D#CI/CD
Securing Workflows in CI Pipelines - Secure Build
Introduce the requirements for secure build and associated tools to secure your build stage in CI/CD pipeline.
19 min read - #Pipeline Controls#NIST#NIST SP 800-218
Relationship Between NIST SP 800-218 and SP 800-204D
Review the relationship between NISTP SP 800-218 and SP 800-204D. Walk through how the SSDF specifically focuses on cloud-native application CI/CD pipelines
11 min read - #SSDF#NIST#NIST SP 800-218
NIST SP 800-218(SSDF)
Secure Software Development Framework enhanced by Software Supply Chain Attack.
22 min read - #Detection#SOC#Detection as Code
Palantir ADS
Palantir's methodology to enhance its detection engineering
4 min read - #Incident Response#Vulnerability Response#Playbook
CISA Incident & Vulnerability Response Playbooks
Incident and Vulnerability Response Playbook Standard
15 min read - #Microservices#NIST#NIST SP 800-204
NIST SP 800-204 Series
The NIST Special Publication Series for Securing Microservices.
5 min read - #DevSecOps
DoD DevSecOps Strategy and Implementation Docs
DevSecOps documents structure of U.S Department of Defense.
5 min read - #NIST#OSCAL#CNCF
NIST OSCAL and associated projects
An introduction to NIST OSCAL and its associated CNCF projects for compliance as code.
5 min read - #NIST SP 800-37(RMF)#NIST SP 800-39#NIST SP 800-30
How NIST's Risk Publications Connect
The connections and relationships between NIST Risk related publications
2 min read - #threat-modeling#STRIDE
Threat Modeling - STRIDE
Conducting STRIDE threat modeling in detail
4 min read - #meta
Hello, World
How this blog is built, and how posts are grouped with tags.
1 min read