280 posts tagged with "Security"
Cybersecurity, smart contract audits, and best practices
Six Traefik Gateway API Advisories in Six Months: The Namespace-Boundary Probes Your Shared Ingress Owes Every Tenant
Traefik shipped six Gateway API isolation advisories between March and August 2026 — including a 9.9 CRITICAL REST-provider exposure and a route-key collision with no workaround. Seven concrete namespace-boundary probes, each with the manifest and the exact assertion, for any platform routing many tenants through one shared ingress.
Kubernetes 1.36 Ships User Namespaces to GA: What Rootless Containers Change for Multi-Tenant PaaS Isolation
Kubernetes 1.36 graduates user namespaces to GA, remapping container root to an unprivileged host UID. What that changes for packing multiple tenants on shared bare metal — the CVEs it defuses, the version matrix your fleet must clear, and the shared-kernel risks it does not fix.
Kubernetes v1.36 Ships Admission Policies That Can't Be Deleted: Closing the Bootstrap Window in Your Fleet's Guardrails
Kubernetes v1.36's manifest-based admission control loads policies from files before the API server serves its first request — undeletable via any RBAC. What it forecloses for a multi-tenant self-hosted PaaS, and the Cluster API bootstrap sequencing that makes guardrails live before the first tenant pod.
Your Base Image Is Six Months Stale: Making Renovate's FROM-Line Patching a Self-Hosted PaaS Default
A git-push PaaS rebuilds your app on every push — and never touches the FROM line between pushes. How a platform-run Renovate loop with digest pinning and health-gated automerge bounds base-image staleness from unbounded to about a day, the exact renovate.json to do it, and where the loop still falls short of buildpack rebase.
Webhook Signature Verification for Git-Push Deploys: What a Self-Hosted PaaS Has to Get Right That GitHub's Own Docs Gloss Over
On a git-push PaaS, the webhook endpoint is a remote build trigger — and HMAC verification is its entire security boundary. A 10-point audit checklist covering the raw-body trap, the === timing leak, the timingSafeEqual length-throw, the SHA-1 header ghost, and the replay gap GitHub's docs never assemble into one place.
Nine Seconds, Zero Backups: What the PocketOS Wipe Demands From a PaaS That Doesn't Manage Your Database
A Cursor agent deleted PocketOS's production database and every backup in nine seconds. The real failures were architectural: co-located backups and an omnipotent API token. Here is the backup design that survives a rogue agent — and what a PaaS that doesn't manage your database still owes you.
Why Self-Hosted PaaS Secrets Managers Still Default to Plaintext Env Vars: A Survey of Coolify, Dokploy, and CapRover
Coolify, Dokploy, and CapRover all hand your production credentials to anyone with dashboard access — a feature-by-feature survey of how each stores secrets, why plaintext env vars are an architectural default, and what a Sealed Secrets or External Secrets Operator pattern on Kubernetes buys instead.
The Tailscale Kubernetes Operator Exposes kube-apiserver Without Touching the Public Internet
84% of internet-observable Kubernetes API servers answer to the public internet. The Tailscale operator's API server proxy replaces the IP allowlist with identity-authenticated tailnet access — here is what changes for a self-hosted fleet, what it costs, and what Headscale users shouldn't assume.
CVE-2026-18381: When Your Operator's CRD Field Becomes a Token Exfiltration Bootstrap
A user-editable upload URL in a Red Hat OpenShift operator let anyone with CR edit access steal its service-account token — no exploit needed, just a redirect. Here's the audit checklist for finding the same bug shape in your own operators.