~ / notes
Write-ups from engagements, labs and the parts of security that don’t fit in a slide. Sanitized by default: no client names, no live credentials, no screenshots of your production.
A VPN authenticates the tunnel, then trusts everything inside it. That single design choice turns one stolen session token into a network-wide walk. Zero trust doesn’t mean “no VPN” — it means every request past the tunnel still has to prove who it is, what it wants and why. Start by inventorying what talks to what; the diagram is usually smaller than the access rules.
An .env file is a plaintext credential with a friendlier name. It ends up in backups, shell history, crash dumps and screenshots. Move secrets behind a broker or vault, scope them to the workload, and rotate on a schedule you can actually keep. If rotation requires a meeting, it won’t happen.
Every log line is a liability with a retention policy attached. Collect what you need to answer “did this happen, and to whom?” — then delete the rest on a timer. Privacy engineering is mostly the discipline of not keeping things. The breach you can’t have is the cheapest one to contain.
Drafts, teardown notes and session announcements go out on Telegram before they land here. No algorithm, no newsletter funnel.
membership
Registration fees for new members — €233, one-time. Checkout is handled by Stripe; card details never touch this site.
€233one-time
register & pay