532 posts tagged with "Security"
Cybersecurity, smart contract audits, and best practices
Firecracker MicroVMs for Multi-Tenant CI: What Per-Build Kernel Isolation Actually Costs
A shared-kernel build pod runs a tenant's arbitrary install scripts and Dockerfiles next to every other tenant's. Firecracker microVMs can close that gap per build — real numbers from BuildBuddy's production fleet included — but per-step isolation, which nobody has actually shipped, is a different and much worse trade.
CVE-2026-24834: The Kata Containers Bug That Turned a Hardware Isolation Boundary Into a Config Default
A container process with nothing but CAP_MKNOD got root inside a Kata Containers microVM meant to be hardware-isolated. Here's the exploit, the exact audit to run against your fleet, and why the fix was a config default, not a KVM flaw.
Your Node Buildpack's --ignore-scripts Flag Didn't Stop Phantom Gyp
A June 2026 npm worm called Phantom Gyp bypassed --ignore-scripts entirely by hiding in binding.gyp instead of a lifecycle script — here's the exact mechanism, why it worked, and what a git-push buildpack needs to do instead of trusting one flag.
10,000 MCP Servers Later, the Hard Part Isn't Building One — It's Being Found and Trusted
MCP passed 10,000 public servers and 97 million monthly downloads in 2026 — but 52% of those servers are abandoned. Here's what building bex's own MCP server into that ecosystem actually requires: the protocol's stateless rewrite, the tool-poisoning threat class, and why shipping one isn't a differentiator anymore.
Your Admin Dashboard Doesn't Need Keycloak: Authelia and Pocket ID as Forward-Auth, Not Full IdP
A concrete Traefik+Authelia and Caddy+Pocket ID+OAuth2-Proxy walkthrough for locking down a self-hosted PaaS's own admin dashboard, plus the RAM/dependency numbers that show why a full IdP is the wrong tool for this specific job — and the line where it stops being wrong.
AWS's New ACME Endpoint Isn't Free: What $1 Per Domain, Every 45 Days, Costs a Multi-Tenant PaaS
AWS Certificate Manager now speaks ACME, but it charges $1 per domain on every issuance and renewal — at a 45-day cert lifetime, that's a metered bill free Let's Encrypt never had. Here's the worked cost comparison.
Backstage Ships MCP Tokens for Claude and Cursor: What Exposing a Golden-Path IDP to AI Agents Actually Requires
Backstage 1.43 lets Claude and Cursor call your golden-path Scaffolder actions with a short-lived, per-user token instead of a shared secret. Here's the actual config, the failure mode an unscoped action list creates, and what a self-hosted PaaS's own MCP server needs to copy.
Better-PaaS Ships Scoped Agent Tokens for Cursor and Claude Code — What an AGPL Self-Hosted PaaS Choosing Managed Databases Over bex's Non-Goal Reveals
Better-PaaS, a single-maintainer AGPL project, ships three-tier scoped agent tokens and seven MCP tools for Cursor and Claude Code — a concrete look at what that buys against bex's own coarser key model, and where Better-PaaS's bundled managed databases trade convenience for the high-availability story a single VPS can't back.
Your Tenants' 'edit' Role Could Steal Another Tenant's DNS Credentials: The cert-manager Challenge Bug and the RBAC Audit to Run Today
A cert-manager bug let any tenant with Kubernetes' built-in edit or admin role steal another tenant's DNS credentials through a crafted ACME Challenge — not from a misconfiguration, but from an RBAC aggregation label almost no one audits. Here's the mechanism and a six-check audit to run against your own multi-tenant TLS setup.