532 posts tagged with "Security"
Cybersecurity, smart contract audits, and best practices
Plex Paywalled Your Own Movies: Three Self-Hosting Rug-Pulls and the Apache 2.0 Test That Catches the Next One
Plex paywalled remote streaming, MinIO stripped its admin console, and NocoDB gated new features behind Enterprise — three self-hosted tools that moved free features behind a paywall in 18 months, and the license checklist that separates Apache 2.0 from open-core risk.
AWS European Sovereign Cloud: Why a Separate German Region Still Can't Close the CLOUD Act Gap
AWS went GA in Brandenburg on January 15, 2026 with a separate German entity, 90 services, and €7.8B behind it. Why physically separate still isn't legally sovereign — scored through the EU's SEAL 0–4 framework and the CLOUD Act's corporate-jurisdiction test.
Coolify v4.0.0 Goes Stable: What a Two-Year Beta Promoted to Stable Actually Guarantees — and What It Doesn't
Coolify shipped v4.0.0 stable on April 27, 2026 after 468 beta tags, 57,000 stars, and production use by thousands — plus 11 disclosed CVEs. What the stable tag actually guarantees for upgrade and security, what single-host Docker architecture it leaves unchanged, and how to decide whether to pin it today.
Dokploy Switched to Plain Apache 2.0 on January 21, 2026 — Why a Late Cleanup Is Harder to Trust Than Starting Clean
Dokploy replaced its custom Apache 2.0 plus commercial appendix with clean Apache 2.0 core on January 21, 2026. A before-and-after of what changed, what still sits under DSAL, and why a retroactive fix is weaker trust than starting clean.
OVHcloud's SecNumCloud GA in June 2026: Why 'EU-Headquartered' Isn't a Sovereignty Certification
OVHcloud's SecNumCloud-qualified instances went GA in June 2026 on ANSSI's 360-control visa. What certified immunity, operational separation, and capital caps require beyond an EU headquarters — and when your PaaS needs to name the visa.
Railway's Access Groups Are Group RBAC Behind a SaaS UI: Here's the Same Boundary as Kubernetes YAML
Railway shipped Access Groups on August 14, 2026 — group-based RBAC for its hosted PaaS. A concrete mapping of the same boundary as Kubernetes RBAC, RoleBindings, and Gateway API policy on a control plane you own.
KEDA v2.20's One-Line RBAC Change Silenced Your Autoscaler's Events for 60 Days
KEDA v2.20 swapped the operator's events RBAC from the core API group to events.k8s.io and dropped the old one — so every KEDA event was forbidden on the default install for 60 days. The exact rule to grant, who actually has to act, and the pre-upgrade checklist for a fleet whose scale-from-zero runs through one controller.
Bring Your Own Hetzner Account: Edka, Cluster API, and the Token With Only Two Permission Levels
A 3-node Hetzner cluster priced three ways — closed PaaS, a BYO-account control plane, and DIY Cluster API — plus the uncomfortable detail underneath all of it: a Hetzner API token has exactly two permission levels and one scope.
The Entrypoint You Didn't Write: Buildpacks Is Moving Its 2.9 MB Launcher Into the Run Image and Rewriting It in Rust
Every buildpack-built image runs a 2.9 MB Go binary you never chose, and it is why your scanner is red. Two open CNB RFCs would move it into the run image and rewrite it in Rust — here is what each one actually fixes, and what it does not.