Skip to main content

280 posts tagged with "Security"

Cybersecurity, smart contract audits, and best practices

View all tags

Read the Platform security guide

Cordyceps: How a Free GitHub Account Hijacked CI/CD at Microsoft, Google, and Cloudflare
·Dora Noda·9 min

Cordyceps: How a Free GitHub Account Hijacked CI/CD at Microsoft, Google, and Cloudflare

A researcher with a free GitHub account and no org access could hijack CI/CD at Microsoft, Google, Cloudflare, Apache, and the Python Software Foundation. Here's what the Cordyceps vulnerability class actually does, and the audit checklist to run against your own build pipeline.

security
cybersecurity
PaaS
self-hosting
Firecracker MicroVMs for Multi-Tenant CI: What Per-Build Kernel Isolation Actually Costs
·Dora Noda·9 min

Firecracker MicroVMs for Multi-Tenant CI: What Per-Build Kernel Isolation Actually Costs

A shared-kernel build pod runs a tenant's arbitrary install scripts and Dockerfiles next to every other tenant's. Firecracker microVMs can close that gap per build — real numbers from BuildBuddy's production fleet included — but per-step isolation, which nobody has actually shipped, is a different and much worse trade.

self-hosting
PaaS
security
Kubernetes
CVE-2026-24834: The Kata Containers Bug That Turned a Hardware Isolation Boundary Into a Config Default
·Dora Noda·8 min

CVE-2026-24834: The Kata Containers Bug That Turned a Hardware Isolation Boundary Into a Config Default

A container process with nothing but CAP_MKNOD got root inside a Kata Containers microVM meant to be hardware-isolated. Here's the exploit, the exact audit to run against your fleet, and why the fix was a config default, not a KVM flaw.

security
self-hosting
PaaS
Kubernetes
+1
Your Node Buildpack's --ignore-scripts Flag Didn't Stop Phantom Gyp
·Dora Noda·8 min

Your Node Buildpack's --ignore-scripts Flag Didn't Stop Phantom Gyp

A June 2026 npm worm called Phantom Gyp bypassed --ignore-scripts entirely by hiding in binding.gyp instead of a lifecycle script — here's the exact mechanism, why it worked, and what a git-push buildpack needs to do instead of trusting one flag.

security
cybersecurity
self-hosting
PaaS
+1
10,000 MCP Servers Later, the Hard Part Isn't Building One — It's Being Found and Trusted
·Dora Noda·9 min

10,000 MCP Servers Later, the Hard Part Isn't Building One — It's Being Found and Trusted

MCP passed 10,000 public servers and 97 million monthly downloads in 2026 — but 52% of those servers are abandoned. Here's what building bex's own MCP server into that ecosystem actually requires: the protocol's stateless rewrite, the tool-poisoning threat class, and why shipping one isn't a differentiator anymore.

Model Context Protocol
AI agents
self-hosting
PaaS
+1
Your Admin Dashboard Doesn't Need Keycloak: Authelia and Pocket ID as Forward-Auth, Not Full IdP
·Dora Noda·9 min

Your Admin Dashboard Doesn't Need Keycloak: Authelia and Pocket ID as Forward-Auth, Not Full IdP

A concrete Traefik+Authelia and Caddy+Pocket ID+OAuth2-Proxy walkthrough for locking down a self-hosted PaaS's own admin dashboard, plus the RAM/dependency numbers that show why a full IdP is the wrong tool for this specific job — and the line where it stops being wrong.

self-hosting
PaaS
security
infrastructure
AWS's New ACME Endpoint Isn't Free: What $1 Per Domain, Every 45 Days, Costs a Multi-Tenant PaaS
·Dora Noda·9 min

AWS's New ACME Endpoint Isn't Free: What $1 Per Domain, Every 45 Days, Costs a Multi-Tenant PaaS

AWS Certificate Manager now speaks ACME, but it charges $1 per domain on every issuance and renewal — at a 45-day cert lifetime, that's a metered bill free Let's Encrypt never had. Here's the worked cost comparison.

security
self-hosting
PaaS
cost-optimization
+1
Backstage Ships MCP Tokens for Claude and Cursor: What Exposing a Golden-Path IDP to AI Agents Actually Requires
·Dora Noda·9 min

Backstage Ships MCP Tokens for Claude and Cursor: What Exposing a Golden-Path IDP to AI Agents Actually Requires

Backstage 1.43 lets Claude and Cursor call your golden-path Scaffolder actions with a short-lived, per-user token instead of a shared secret. Here's the actual config, the failure mode an unscoped action list creates, and what a self-hosted PaaS's own MCP server needs to copy.

Model Context Protocol
AI agents
self-hosting
PaaS
+1
Better-PaaS Ships Scoped Agent Tokens for Cursor and Claude Code — What an AGPL Self-Hosted PaaS Choosing Managed Databases Over bex's Non-Goal Reveals
·Dora Noda·8 min

Better-PaaS Ships Scoped Agent Tokens for Cursor and Claude Code — What an AGPL Self-Hosted PaaS Choosing Managed Databases Over bex's Non-Goal Reveals

Better-PaaS, a single-maintainer AGPL project, ships three-tier scoped agent tokens and seven MCP tools for Cursor and Claude Code — a concrete look at what that buys against bex's own coarser key model, and where Better-PaaS's bundled managed databases trade convenience for the high-availability story a single VPS can't back.

self-hosting
PaaS
AI agents
Model Context Protocol
+1
Showing 37–45 of 280 posts