Tightening Hermes Secrets with Bitwarden
A practical walkthrough for moving Hermes API keys out of local env files and into Bitwarden Secrets Manager, with verification and cleanup steps.
Category: security
Shared AI Artifacts Aren't Private From a Hard-to-Guess URL
A security note on the Claude shared-chat and Artifacts leak, and why AI workspaces need clear boundaries between private, unlisted, and public content.
Tightening Hermes Agent Security for Local Sensitive Work
How I tightened my Hermes agent setup after adding a local model for PII and credential-sensitive work: tool limits, manual approvals, and a quiet watchdog.
Securing Hermes Agent with OpenShell
Why I run Hermes Agent inside OpenShell when it reads untrusted content, and how filesystem, network, process, and credential policy change the security model.
Identity-Aware GCS Access Instead of Hashed Secret URLs
Replacing hashed 'secret' URLs in Google Cloud Storage with IAM Conditions and domain-restricted access that verifies identity instead of hiding a path.
PostgreSQL MD5 to SCRAM-SHA-256: a zero-downtime migration
PostgreSQL 18 deprecates MD5 authentication, and migrating to SCRAM-SHA-256 in mixed mode lets you switch pg_hba.conf without downtime or forced app changes.
Securing AWS Credentials: aws-vault vs 1Password
Storing long-lived AWS access keys in ~/.aws/credentials is a common anti-pattern; aws-vault and the 1Password AWS Shell Plugin both fix it with short-lived STS tokens.
User Impersonation in Rails with the Pretender Gem
User impersonation lets an admin temporarily act as another user for debugging and support, and the pretender gem handles the current_user switch and session state.
Detecting Cloudflare Zero Trust Beyond the WARP Flag
WARP can report itself as off while Zero Trust still routes your Mac's traffic; here is how to check DNS, ASN, and DoH to find out for sure.
Monitor Cloudflare WARP Status on macOS with launchd
A launchd-scheduled shell script that detects when Cloudflare WARP reconnects on a company-managed Mac and sends a desktop notification.
Migrating OTP Secrets Out of Google Authenticator
How to export TOTP secrets from Google Authenticator with the otpauth tool and import them into Authy, Aegis, or 1Password without losing account access.
ARG, ENV, and BuildKit secrets: how each behaves in Docker
ARG, ENV, exported shell variables, and BuildKit secret mounts each persist differently in a Docker image, and only one of them is actually safe for tokens.
Docker secrets: how layers leak them and how BuildKit fixes it
Docker's layer history persists secrets baked into ARG and ENV instructions, and BuildKit secret mounts are the practical fix that keeps them out of the image.
OpenVPN: Restrict Client Access to Specific IPs Only
How to restrict OpenVPN clients to a limited set of destination IPs, using client-config-dir routes, a client-connect script, and iptables rules.
Fixing Multi-Tab Session Bugs with JWT and sessionStorage
How cookie-based session state breaks when a user opens multiple tabs in a single-page app, and how splitting auth into JWT plus sessionStorage fixes it.
Container Security with Fine-Grained Permission Control
How Linux file permissions and Kubernetes securityContext settings enforce least-privilege access for containerized workloads, with a worked example.
Rails Secrets: Credentials, 1Password, and Cloud Vaults
A rundown of Rails credentials, environment variables, 1Password CLI, and cloud secret managers like AWS Secrets Manager and Vault, and when to use each.
Config Approaches: Files, Env Vars, and Config Servers
A comparison of YAML config files, Rails encrypted credentials, environment variables, and centralized config servers, with the trade-offs of each approach.
Defending Against DoS Attacks
How to defend against DoS and DDoS attacks with request throttling, input validation, firewall rules, load balancers, and cloud-based mitigation.
NETSCREEN 5GT密码破解方法
恢复 NetScreen 5GT 密码的两种方法：通过 Console 输入序列号初始化，或用重置针孔硬复位，以及导入旧配置文件前的编辑注意事项。