Results for “cipher-suites”

Manage secrets, cryptographic keys, and certificates in Azure Key Vault using the Python SDK.

Chief Security Officer mode. (gstack)

Integrate gitleaks and trufflehog into CI/CD pipelines to detect leaked secrets before deployment.

Builds AWS Nitro Enclave-based confidential computing environments with cryptographic attestation, KMS policy integration, and secure vsock communication for processing sensitive data.

Implements security-sensitive changes with conservative trust boundaries, secret protection, tests, and verification.

Chief Security Officer mode. (gstack)

Store, retrieve, and automatically rotate credentials, API keys, and other secrets using AWS Secrets Manager.

CI security scanning: secrets, deps, SAST, triage, expiring exceptions

Design and implement a comprehensive DevSecOps pipeline in GitLab CI/CD integrating SAST, DAST, container scanning, dependency scanning, and secret detection.

Detect and prevent hardcoded secrets in git repositories using Gitleaks, including pre-commit hooks, CI/CD integration, custom rules, baseline management, and remediation workflows.

Signs and verifies software artifacts using Sigstore's keyless signing, Rekor transparency log, and Fulcio certificate authority, integrating into CI/CD pipelines and Kubernetes admission controls.

Detect and prevent privilege escalation in Kubernetes pods by monitoring security contexts, capabilities, and syscall patterns with Falco and OPA policies.

Audits Kubernetes pods for container escape vectors by analyzing privileged mode, dangerous capabilities, host namespace sharing, and writable hostPath mounts using the Kubernetes Python client.

Security Practices — Cryptographic Safety, Memory Zeroization & Hardened I/O

Authorized assessment of federated identity systems covering SAML, OIDC, and OAuth2 flows, SSO misconfigurations, and token confusion issues.

Audits codebases for leaked secrets and hardcoded credentials, generates .env templates, configures secrets management with AWS Secrets Manager, Vault, Doppler, or GCP Secret Manager, sets up credential rotation, and integrates secrets into CI/CD pipelines via OIDC federation.

Explains cryptographic primitives and provides Python implementations for encryption, hashing, key exchange, and digital signatures.

Store, retrieve, and manage secrets like passwords, API keys, and connection strings using Azure Key Vault with the Java SDK.

Hardens Google Kubernetes Engine (GKE) clusters with Workload Identity, Secret Manager, RBAC, Binary Authorization, Network Policies, and Pod Security Standards.

Manage secrets and keys in Azure Key Vault using the JavaScript SDK, including CRUD operations, cryptographic functions, backup/restore, and key rotation.

Take over Active Directory user and computer accounts by writing alternate certificate keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, and Certipy, then authenticate via PKINIT.

Verify container image integrity across CI/CD pipelines using the in-toto framework to generate and check cryptographically signed attestations.

Use this when reviewing or designing how secrets, API keys, service credentials, signing keys, tokens, and environment-specific credentials are stored, loaded, rotated, and kept out of untrusted runtimes.

Centralize secrets management with HashiCorp Vault, including dynamic secret generation, transit encryption, PKI certificate management, and Kubernetes integration.

Authorized security assessment for cloud, container, and Kubernetes environments covering metadata SSRF, IAM misconfigurations, container escape paths, and cluster RBAC review.

Implements layered security for Flutter apps: code obfuscation, certificate pinning, secure storage, encryption, biometric authentication, and root/jailbreak detection.

Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure.

Audit and attack session cookies via missing Secure/HttpOnly/SameSite attributes, overly broad Domain/Path scope, non-expiring persistent cookies, absent __Host- and __Secure- prefixes, browser cache leakage (Cache-Control: no-store missing), session token predictability via Burp Sequencer analysis, server-side session not invalidated on logout, and SSO single-logout bypass. Tools: Burp Suite Repeater/Sequencer, OWASP ZAP, EditThisCookie, Tamper Data, Cookiebro.

Hardens Django applications against common vulnerabilities with production settings, authentication, authorization, SQL injection and XSS prevention, and secure deployment configurations.

Systematically evaluates Kubernetes cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets using tools like kube-hunter, Kubescape, and kube-bench.

Store and retrieve API keys, passwords, and credentials in an HSM-backed encrypted vault via MCP or REST API, with policy-based access control, secret rotation, multi-chain signing, and prompt injection scanning.

age file encryption reference — the modern, simple alternative to GPG. Covers key generation, X25519 encryption, SSH key support, passphrase mode, pipe patterns, SOPS integration, YubiKey plugins, and security considerations. By Filippo Valsorda.

Manage environment variables and secrets securely in Claude Code sessions, ensuring sensitive values are never exposed in logs, diffs, or context.

Assess cloud configuration risks including IAM privilege escalation, public storage exposure, network over-permissioning, and infrastructure-as-code misconfigurations.

Audita infraestrutura e pipeline em busca de vulnerabilidades, credenciais vazadas, IAM excessivo e exposição pública, com recomendações de hardening e classificação de severidade.