Runtime, cloud & APIs
Control exposure, contain failures, and defend applications in their operating environment.
26 guides · 3 labs · 3 local projects · 1 learning path
Start here
APIs and background work
Inventory, limits and protocol-specific controls for APIs and queued work.
Bound API work, not just request counts
Protect availability and operating cost with limits on input, per-request work, concurrency, queues, and downstream spending.
Maintain an API inventory and prevent gateway bypass
Connect documented routes, deployed listeners and backend trust so retired or direct paths do not bypass the intended controls.
Apply security limits to GraphQL, WebSocket and gRPC operations
Carry authorization and resource budgets past the initial HTTP request into resolvers, messages and long-lived streams.
Bound background jobs and make retries safe
Keep queues, workers and paid dependencies within a defined budget when clients retry, cancel or disappear.
Keep HTTP services up under application-layer DDoS
Bound every phase of an HTTP request, patch for the HTTP/2 attack classes, rate limit at the edge and the origin, and shed load deliberately, with nginx, Envoy and Node.js settings tested against slow clients and bursts.
Cloud and infrastructure as code
Review cloud permissions and infrastructure changes as access changes.
Review infrastructure changes as access changes
Inspect the effective permissions, exposure, sensitive state, and recovery implications of a proposed infrastructure change.
Review cloud permissions and role trust together
Distinguish who can obtain a cloud identity from what that identity can do, then test the effective access path.
Test infrastructure policy and detect security-relevant drift
Connect source configuration, the proposed plan and deployed resources so a safe review does not become stale after deployment.
Prevent subdomain takeover from dangling DNS records
A DNS record that outlives its cloud resource lets whoever claims the name serve content on your domain. Bind records to resources in IaC, remove the record first, verify domains and scan for dangling records.
Apply a security baseline across AWS, Azure and Google Cloud
Give workloads platform identities instead of keys, guard the instance metadata endpoint, block public storage, keep audit logs past the default retention, close inbound admin ports and use the native secret store, with tested Terraform for AWS, Azure and Google Cloud.
Choose cloud security posture tools and apply zero trust
What CSPM, CWPP, CIEM, CNAPP, DSPM and ASPM each find and miss, how they overlap, how to evaluate one on your own accounts, and how zero trust as defined in NIST SP 800-207 uses what they measure.
Case study: the CircleCI security incident (January 2023)
How a session stolen from one engineer's laptop reached CircleCI's production systems and customers' stored secrets in 2023, and what platform operators and CI users should change.
Case study: Microsoft AI researchers' over-permissive SAS token (2023)
How an over-permissive Azure Storage SAS token in a public repository for AI models exposed internal Microsoft data in 2023, and how to scope, scan for and revoke signed URLs.
Containers, Kubernetes and service identity
Run workloads with least privilege and authenticate service-to-service calls.
Run Kubernetes workloads with only the privileges they need
Review pod settings, service accounts and effective permissions together before treating a namespace as an isolation boundary.
Prove network and admission policies enforce the intended boundary
Verify allowed traffic and rejected deployments in the cluster instead of treating policy files as evidence of isolation.
Authenticate workloads and authorize their service actions
Use service identities, mutual TLS and function permissions without mistaking an encrypted connection for complete authorization.
Harden managed Kubernetes on EKS, AKS and GKE
Know what your provider secures and what you still own, then lock down API access, cloud identity, nodes, pod privileges and admission with settings that are generally available in Kubernetes 1.37, checked against the CIS and NSA/CISA baselines.
Harden container images from Dockerfile to admission
Build minimal, non-root images pinned by digest, keep secrets out of every layer, then scan, sign and verify the exact digest before it runs with dropped privileges.
Harden the images you ship against CIS, STIG and SCAP benchmarks
Hold each image your team ships (container base images, golden VM images, Kubernetes node images) to a published benchmark through a pinned SCAP Security Guide profile, scan every build with OpenSCAP, and fail the build on any failure that a deviation register does not explain with an owner, an approver and an expiry.
Case study: ingress-nginx CVE-2025-1974 and the exposed admission webhook (2025)
How an admission webhook open to the whole Pod network made ingress-nginx's configuration-injection bugs a 9.8 cluster-takeover risk in 2025, and what its 2026 retirement means.
Proxies, CDNs and edge rules
Keep request boundaries and caches consistent across intermediaries.
Operate edge rules without hiding application defects
Tune WAF and abuse controls against legitimate traffic, parser behavior and measurable business effects.
Keep HTTP request boundaries consistent across intermediaries
Trace framing disagreements, reject ambiguous requests and verify what reaches the origin with a real loopback proxy project.
Prevent shared-cache poisoning and private-response deception
Define lookup and storage policy, trace cache/origin interpretation differences and verify both public reuse and private isolation.
Detection and response
Log what an investigation needs and turn runtime events into containment.
Create security logs someone can investigate
Record meaningful decisions with consistent structure, protect the resulting evidence, and prove that important events reach an operational owner.
Turn runtime events into a tested investigation and containment path
Collect evidence that answers a concrete security question and rehearse the response without destroying the facts needed to investigate.
Detect container and host threats at runtime with eBPF sensors and cloud services
Watch process, file and network activity inside containers with an eBPF sensor or a managed cloud agent, write and test rules for the attacks you expect, tune them with narrow exceptions and contain a compromised pod without destroying evidence.
Privileged container lab: Reject a privileged workload before deployment
A deployment review checks only the first container. A privileged init container slips through. Repair a deliberately small admission predicate and test all container lists.
NetworkPolicy lab: Lock down a shop namespace
One hurried NetworkPolicy lets every pod in every namespace reach the API, and nothing protects the web tier or the database. Rewrite the shop namespace’s policies so only the flows the application needs are allowed.
IAM trust policy lab: Evaluate a role trust policy against the confused deputy
An evaluator for AWS sts:AssumeRole trust policies matches the principal and action but ignores the Condition block and does not honour an explicit Deny, so a broad principal can assume a role without the external id — the confused deputy. Repair evaluate_trust to enforce conditions and Deny.
Repair a real proxy and shared cache
Reproduce a private-response leak, repair cache policy and verify HTTP framing with real origin/proxy servers and raw socket requests.
Verify Kubernetes admission and network boundaries
Repair warning-only admission and an overbroad network rule, then apply them to a disposable cluster and probe allowed and denied paths.
Gate an image build on a CIS scan and a deviation register
Repair a CI gate that reads a real OpenSCAP scan of ubuntu:24.04 against the CIS Level 1 Server profile, until unregistered failures, errors, expired deviations and scans of the wrong profile or content version fail the build.