Security
July 20269 min read
Expose Self-Hosted Services Safely with Cloudflare Tunnel
How I reach my homelab and VPS from anywhere with zero inbound ports open — cloudflared config, ingress rules, and Zero Trust access policies.
Read More
Blog
Security
Articles on application and infrastructure security — secure pipelines, authentication, and practical security engineering.
11 articles
Security
July 20269 min read
eBPF Observability with Cilium Tetragon on Kubernetes
How eBPF runs sandboxed programs inside the Linux kernel without modules, and how Tetragon turns that into process, network, and file visibility on Kubernetes.
Read More
Security
July 20269 min read
The IDOR That Let One Branch Read Another Branch's Revenue
A real IDOR in a multi-branch ERP: how a detail endpoint that fetched by id alone leaked another branch's revenue, and the branchId-scoping fix I rolled across every Prisma module.
Read More
Security
July 202610 min read
Building e-KYC for Indonesian Fintech: NIK/Dukcapil Verification Done Right
How to verify NIK/KTP identity against Dukcapil through authorized providers, add face-match and liveness, and handle sensitive data under UU PDP.
Read More
Security
July 20269 min read
Hardening Linux Services with systemd Sandboxing
How I lock down Linux daemons from the outside using systemd's built-in sandbox — filesystem, temp, privileges, and syscalls — then measure the result.
Read More
Security
July 20268 min read
Encrypting Secrets in Git with SOPS and age
How to keep API keys and database credentials safely inside a Git repository using SOPS and age, with per-environment keys and CI decryption.
Read More
Security
July 20269 min read
Automated Secrets Rotation: A Strategy That Survives Audits
A practical blueprint for rotating credentials automatically, using short-lived and dynamic secrets, dual-secret cutovers, and fast leak detection so audits stop being a scramble.
Read More
Security
July 202610 min read
Software Supply Chain Security: SBOMs and Sigstore
How to generate SBOMs, sign artifacts with Sigstore and cosign, verify SLSA provenance, and enforce all of it as a CI gate.
Read More
Security
July 202610 min read
Passkeys in Next.js: Passwordless Auth with WebAuthn
A practical walkthrough of adding passkey login to a Next.js app: the WebAuthn registration and authentication ceremonies, storing credentials safely, and what to offer users whose devices do not support passkeys.
Read More
Security
May 202610 min read
Zero Trust Security Architecture for Cloud-Native Applications: A Practical Guide
A technical deep-dive into implementing Zero Trust security in Kubernetes environments using mTLS, SPIFFE/SPIRE, and network micro-segmentation. Includes BSSN compliance context for Indonesia, Istio PeerAuthentication configuration, and practical guidance on avoiding security theater.
Read More
Security
January 202610 min read
UU PDP No. 27/2022: The Developer's Compliance Guide for Indonesia's Data Protection Law
Indonesia's Personal Data Protection Law (UU PDP No. 27/2022) became fully enforceable in October 2024, with penalties up to Rp 20 billion. This guide translates UU PDP's five core obligations into concrete engineering practices: pseudonymization, PostgreSQL RLS, audit logging, and data subject request APIs.
Read More