Platform security
Securing a platform other people deploy to: tenant isolation at the ingress, certificates that renew themselves, container images with unsafe defaults, and retiring the shared cluster-admin credential.
Start here
- Six Traefik Gateway API Advisories in Six Months: The Namespace-Boundary Probes Your Shared Ingress Owes Every TenantTraefik shipped six Gateway API isolation advisories between March and August 2026 — including a 9.9 CRITICAL REST-provider exposure and a route-key collision with no workaround. Seven concrete namespace-boundary probes, each with the manifest and the exact assertion, for any platform routing many tenants through one shared ingress.
- step-ca vs Let's Encrypt: What an Internal-Only ACME CA Buys Your Fleet's Service-to-Service TLSLet's Encrypt logs every certificate publicly and refuses private hostnames by design. step-ca gives a Cluster API fleet automated internal TLS with 24-hour certs and no CT-log exposure — here's the full setup, plus the honest cost of running your own CA.
- 45-Day Let's Encrypt Certificates Are Here: The Renewal-Automation Bar Every Self-Hosted PaaS Now Has to ClearLet's Encrypt's tlsserver profile dropped to 45-day certificates on May 13, 2026, and the default follows by 2028. A five-point audit of what a halved renewal window demands from a self-hosted PaaS's ACME pipeline: percentage-based margins, retry isolation, external expiry alerting, ARI, and 1-hour authorizations.
- Gitea's Docker Image Trusted Every Proxy on Earth: A Five-Question Audit for the Defaults Baked Into Your ImagesGitea's container image shipped REVERSE_PROXY_TRUSTED_PROXIES = * while its own docs said loopback-only — CVSS 9.8, armed by the very SSO flag a platform is supposed to set. Five runnable questions, plus a CI check, for auditing the defaults hiding in every image and chart your platform ships.
- OpenID Certified at 30 MB: What Pocket ID and Tinyauth's Formal OIDC Conformance Actually Proves for Your PaaS Admin LoginPocket ID and Tinyauth both passed the OpenID Foundation's conformance suite in 2026. What the certification actually tests, what it doesn't prove, and when a 30 MB IdP is enough to gate a self-hosted PaaS admin surface.
- Bring Your Own Hetzner Account: Edka, Cluster API, and the Token With Only Two Permission LevelsA 3-node Hetzner cluster priced three ways — closed PaaS, a BYO-account control plane, and DIY Cluster API — plus the uncomfortable detail underneath all of it: a Hetzner API token has exactly two permission levels and one scope.
In the documentation
Terms to know
Run this on infrastructure you own
bex is the open-source, AI-native Render alternative — push a git repo and get a running HTTPS service on your own machines.
Get started with bex