Network Security
What to Do When a Device Hits CISA KEV
When a KEV-listed vulnerability may affect your device, confirm model, build, feature and exposure. Preserve useful evidence, contain applicable risk and follow supported remediation without assuming the device is already compromised.
Edge Device Patch Priority Playbook
A patch-priority playbook for routers, firewalls, VPN gateways, NAS appliances, and other internet-facing edge devices.
Evil Twin Wi-Fi on Planes and Hotels: How to Verify the Hotspot
A familiar SSID is not proof of a legitimate airline or hotel hotspot. Use this verification workflow, then learn what PMF, HTTPS, captive portals, and VPNs can and cannot protect.
Media API Keys in Access Logs: Check for Exposure and Rotate Safely
Trace where media API keys may persist in URLs, logs, support bundles and backups. Search without exposing secrets, restrict original evidence, share redacted copies and rotate affected credentials across dependent integrations.
Restore From a Compromised Backup Without Reinfecting Production
Recover needed data from suspect backups in isolation, rebuild executable components from trusted sources, replace exposed credentials, and require application checks plus security review before reconnecting.
Tailscale vs Headscale: What Self-Hosting the Control Plane Changes
Headscale moves Tailscale-compatible coordination, identity integration, policy distribution, upgrades, and recovery into your infrastructure. It does not automatically move peer traffic, remove DERP, or eliminate endpoint and application security work.
UniFi VLANs Without Breaking AirPlay, Printers, and Smart Home Gear
A UniFi VLAN guide for keeping AirPlay, AirPrint, printers, casting, HomeKit, and smart-home devices usable without flattening the network.
IoT Device Security Checklist: Firmware, Updates, and End of Support
Review an IoT device's firmware source, update and recovery path, vulnerability-disclosure record, exposed services, support dates, and isolation options before purchase and at each lifecycle review.
How to Block AI Scrapers: robots.txt, Rate Limits, and Access Control
State crawler preferences with robots.txt, enforce request policies with bot controls and rate limits, and authenticate private content. Test exceptions for legitimate traffic and retain logs without assuming every unwanted scraper is blocked.
Homelab SSO: Authentik vs Authelia vs Pocket ID
A practical homelab SSO comparison covering Authentik, Authelia, Pocket ID, OIDC, SAML, proxy auth, passkeys, MFA, and recovery planning.