Blog posts about security

A lightweight recipe for hosting Renovate yourself on GitLab CI so you keep control of credentials, schedules, and runner performance.

SQL injection in the application code, an RSA private key in version control, 5941 vulnerabilities in the base image. These are not hypothetical risks — they are findings from a real pipeline run. In this post, we show how GitLab Ultimate catches all of them automatically, across seven scanner types, without a single third-party tool.

In a previous insightful post by a collegue of mine, titled Connect your Gitlab CI/CD pipeline to AWS via OIDC, the author discussed the basics of connecting GitLab Pipelines with AWS using OpenID Connect. Building upon her valuable insights, this post will

You just booted a fresh Ubuntu VPS and it has a public IP, a root password and nothing else standing between it and the internet's background noise. Here's the hardening pass I run on every box before it does anything useful: SSH locked to keys, netfilter on IPv4 and IPv6, Fail2Ban, automatic security patches and a deploy user that can restart exactly three things.