- prod-opssecurity
The certificate expired in silence, and the scans never stopped
A renewal cron ran every night for months and never renewed anything, because of one wrong letter. Meanwhile the server took thousands of scans and brute-force attempts a day. Here is what CrowdSec actually blocked, the nginx rules that held, the ports I should never have exposed, and why Cloudflare is the next layer.
-
PII and data masking: how to stop leaking personal data everywhere
Personal data spreads into logs, staging, analytics, and exports, far beyond the users table. A practical guide to masking, pseudonymization, and anonymization, and knowing which one you actually did.
-
GDPR data retention and deletion: a practical guide for developers
The two GDPR duties engineers get wrong most often are keeping data too long and failing to fully delete it. A hands-on guide to retention windows, the right to erasure, and the part nobody plans for: backups.
-
Docker bypassed my firewall: the database port was open to the internet
My host firewall blocked port 5432. It was reachable from the internet anyway, because Docker writes its own iptables rules that your INPUT and ufw rules never see. Why it happens, and how to actually close it.
-
Cloudflare under the hood: how it works and how attackers try to get around it
What actually happens when a request hits a Cloudflare-protected site, how Turnstile distinguishes bots from humans, and the techniques attackers use to find the origin server behind the proxy.