Real systems I run and defend at home. Details are generalized: no hostnames, addresses or identifiers.
Threat-Prioritized Vulnerability Management
- Trivy
- CISA KEV
- GitHub Advisories
- n8n
- Python
Nightly Trivy scans of every container image and Linux host, diffed against a baseline and enriched with the CISA Known Exploited Vulnerabilities catalog. Findings are ranked Actively Exploited → Critical → High, so an exploited “High” outranks every “Critical”, and anything an auto-updater already covers is filtered out, leaving only what nothing else will fix. A companion watch matches vendor and GitHub security advisories against the live software inventory.
~2,400 raw findings reduced to ~17 component-level actions
Read the write-up →
AI-Agent Remediation Pipelines
- n8n
- Headless AI agent
- Python
- Home Assistant
- Discord
Eleven monitors (vulnerabilities, backup freshness, TLS renewal, service health, VPN-dependent containers and more) hand confirmed failures to a headless AI agent that diagnoses the fault and, where it is safe, fixes it. Destructive actions pause for one-tap approval on a phone, third-party advisory text is framed as untrusted input to resist prompt injection, and every run files a report that is posted exactly once, after delivery succeeds.
11 pipelines · approval-gated · prompt-injection aware
Read the write-up →
Zero-Trust Exposure & Hardening
- Cloudflare Tunnel
- Zero Trust Access
- WAF
- CrowdSec
- Pi-hole
Self-hosted services are published through Cloudflare Tunnels instead of opened ports, with admin apps behind Zero Trust Access and WAF rules (including geo restrictions) in front. CrowdSec and Pi-hole DNS filtering cover the edge, and API tokens rotate automatically every 90 days through a separate least-privilege rotator. This site ships a strict Content-Security-Policy with no inline script, HSTS and hardened response headers.
No inline script · 7 security headers · 90-day token rotation
Read the write-up →
