280 posts tagged with "Security"
Cybersecurity, smart contract audits, and best practices
The Entrypoint You Didn't Write: Buildpacks Is Moving Its 2.9 MB Launcher Into the Run Image and Rewriting It in Rust
Every buildpack-built image runs a 2.9 MB Go binary you never chose, and it is why your scanner is red. Two open CNB RFCs would move it into the run image and rewrite it in Rust — here is what each one actually fixes, and what it does not.
Your MCP Server Lost Its Confirmation Prompt on July 28: Rebuilding the Delete Gate on input_required
The 2026-07-28 MCP spec deleted server-initiated requests, and with them the only way a destructive tool could stop and ask a human. Here is the replacement on the wire: a delete_service gate built on resultType input_required, the signed requestState ticket that survives a round-robin load balancer, and the once-only guarantee the protocol makes your problem.
Retiring cluster-admin and the Shared Bastion: Kubernetes' Access-Broker Pattern for Production Debugging
Kubernetes' March 2026 guidance replaces cluster-admin exec and shared bastions with a three-layer access broker: least-privilege RBAC, group-based bindings, and a just-in-time gateway — plus how to wire it into a multi-tenant PaaS debug-shell feature without rebuilding the anti-pattern.
Bitwarden's July 2026 Update Broke Every Vaultwarden Overnight: The Real Cost of Reimplementing a Protocol You Don't Own
Bitwarden's 2026.7.0 client silently repurposed a wire-format field Vaultwarden had emitted for eight years, breaking every self-hosted deployment overnight. A concrete cost accounting of running a compatible reimplementation of a protocol you don't control — and why bex's Render-compatible API carries the same risk.
Daytona's 90ms vs E2B's 150ms: What a 40% Cold-Start Gap at Price Parity Actually Means at 10,000 Sandboxes a Day
2026 benchmarks show Daytona starting sandboxes in ~90ms vs E2B's ~150ms at identical ~$0.0504/vCPU-hour pricing. The worked math at 1K–100K sandboxes a day shows the gap costs pennies and only matters for serial agent loops — concurrency caps, isolation, and lifecycle hygiene decide the rest.
Gitea's Docker Image Trusted Every Proxy on Earth: A Five-Question Audit for the Defaults Baked Into Your Images
Gitea's container image shipped REVERSE_PROXY_TRUSTED_PROXIES = * while its own docs said loopback-only — CVSS 9.8, armed by the very SSO flag a platform is supposed to set. Five runnable questions, plus a CI check, for auditing the defaults hiding in every image and chart your platform ships.
45-Day Let's Encrypt Certificates Are Here: The Renewal-Automation Bar Every Self-Hosted PaaS Now Has to Clear
Let's Encrypt's tlsserver profile dropped to 45-day certificates on May 13, 2026, and the default follows by 2028. A five-point audit of what a halved renewal window demands from a self-hosted PaaS's ACME pipeline: percentage-based margins, retry isolation, external expiry alerting, ARI, and 1-hour authorizations.
OpenID Certified at 30 MB: What Pocket ID and Tinyauth's Formal OIDC Conformance Actually Proves for Your PaaS Admin Login
Pocket ID and Tinyauth both passed the OpenID Foundation's conformance suite in 2026. What the certification actually tests, what it doesn't prove, and when a 30 MB IdP is enough to gate a self-hosted PaaS admin surface.
step-ca vs Let's Encrypt: What an Internal-Only ACME CA Buys Your Fleet's Service-to-Service TLS
Let's Encrypt logs every certificate publicly and refuses private hostnames by design. step-ca gives a Cluster API fleet automated internal TLS with 24-hour certs and no CT-log exposure — here's the full setup, plus the honest cost of running your own CA.