AI for DevOps Security & Hardening
Use AI to review infrastructure security, harden Linux servers, detect risky commands, audit CI/CD pipelines, and improve production safety.
147 copy-paste prompts · 113 in-depth guides Jump to prompts Jump to guides
Prompts
- Intermediate
Ansible Playbook & Vault Security Review Prompt
Review Ansible playbooks and roles for plaintext secrets, unsafe privilege escalation, and host-key/command-injection risks, and produce a hardened Vault, become, and templating configuration.
- Claude
- ChatGPT
- Cursor
Open prompt - Advanced
Consul ACL & Gossip Encryption Hardening Review Prompt
Review a HashiCorp Consul cluster for open ACLs, unencrypted gossip and RPC, and over-broad tokens, and produce a hardened default-deny ACL, TLS, and encryption configuration.
- Claude
- ChatGPT
- Cursor
Open prompt - Intermediate
Container Registry Authentication & Access Hardening Review Prompt
Review a container registry and its pull/push credentials for anonymous access, long-lived tokens, and over-broad scopes, and produce a hardened authentication, image-pull-secret, and access-control design.
- Claude
- ChatGPT
- Cursor
Open prompt - Intermediate
Elasticsearch / OpenSearch Security Hardening Review Prompt
Review an Elasticsearch or OpenSearch cluster for anonymous access, missing TLS, and over-broad role mappings, and produce a hardened authentication, transport-encryption, and least-privilege RBAC configuration.
- Claude
- ChatGPT
- Cursor
Open prompt - Advanced
gRPC TLS, Authentication & Authorization Review Prompt
Review a gRPC service for insecure channels, missing per-call authentication, and absent method-level authorization, and produce a hardened transport, credential, and interceptor design.
- Claude
- ChatGPT
- Cursor
Open prompt - Advanced
Kafka mTLS & ACL Authorization Hardening Review Prompt
Review an Apache Kafka cluster for missing encryption-in-transit, weak client authentication, and over-broad ACLs, and produce a least-privilege listener, mTLS, and topic authorization configuration.
- Claude
- ChatGPT
- Cursor
Open prompt - Intermediate
Log Redaction & PII/Secret Scrubbing Pipeline Review Prompt
Review a logging pipeline for secrets and PII leaking into logs, and produce a hardened redaction, field-masking, and retention design that scrubs sensitive data before it reaches storage or a SIEM.
- Claude
- ChatGPT
- Cursor
Open prompt - Intermediate
osquery Endpoint Threat-Hunting Query Design Prompt
Design osquery scheduled packs and detection queries for defensive endpoint visibility — persistence, suspicious processes, and integrity drift — with tuning to control noise and performance.
- Claude
- ChatGPT
- Cursor
Open prompt - Advanced
WebAuthn & Passkey Authentication Hardening Review Prompt
Review a WebAuthn/FIDO2 passkey implementation for weak relying-party settings, missing attestation and user-verification checks, and replay/downgrade gaps, and produce a hardened registration and authentication ceremony.
- Claude
- ChatGPT
- Cursor
Open prompt - Advanced
GraphQL API Security Hardening Review Prompt
Review a GraphQL API for the abuse vectors unique to the query model — unbounded depth, introspection exposure, batching amplification, and field-level authorization gaps — and get a hardened schema and gateway config.
- Claude
- ChatGPT
- Cursor
Open prompt - Advanced
SAML SSO Assertion Security Review Prompt
Review a SAML single sign-on integration for the assertion-handling flaws that cause authentication bypass — signature validation gaps, XML canonicalization tricks, audience/recipient scoping, and replay — and get a hardened SP configuration.
- Claude
- ChatGPT
- Cursor
Open prompt - Advanced
Inbound Webhook HMAC Signature Verification Review Prompt
Review how your service authenticates inbound webhooks (Stripe, GitHub, Slack, custom senders) so forged, replayed, or tampered payloads are rejected before they trigger business logic.
- Claude
- ChatGPT
- Cursor
Open prompt - Intermediate
Password Hashing & Credential Storage Review Prompt
Review how an application hashes and stores user passwords and secrets, and produce a hardened credential-storage design using a modern memory-hard KDF with correct parameters, salting, and migration.
- Claude
- ChatGPT
- Cursor
Open prompt - Intermediate
Session Cookie Security Hardening Review Prompt
Review how a web application issues and manages session cookies and produce a hardened cookie policy covering Secure, HttpOnly, SameSite, scoping, lifetime, and session-fixation defenses.
- Claude
- ChatGPT
- Cursor
Open prompt - Advanced
systemd Service Sandboxing Hardening Review Prompt
Review a systemd unit and produce a hardened, least-privilege sandbox using directives like ProtectSystem, NoNewPrivileges, capability bounding, syscall filtering, and namespace isolation without breaking the service.
- Claude
- ChatGPT
- Cursor
Open prompt - Intermediate
Application Secrets Sprawl Discovery Audit Prompt
Audit where an application's secrets actually live (env files, config, container images, CI variables, code) to find sprawl, plaintext exposure, and missing rotation, then design a path to a managed secrets store.
- Claude
- ChatGPT
Open prompt - Advanced
IAM Role Trust Policy & Confused-Deputy Audit Prompt
Audit AWS IAM role trust policies for over-broad assume-role principals, missing external IDs, and confused-deputy gaps, and tighten them to least-privilege without breaking legitimate cross-account or service access.
- Claude
- ChatGPT
Open prompt - Advanced
Data-Flow & Trust-Boundary Threat Model Prompt
Build a data-flow-diagram-driven threat model for a service — identifying trust boundaries, enumerating threats with STRIDE, and ranking concrete mitigations — to harden the design before attackers find the gaps.
- Claude
- ChatGPT
Open prompt - Advanced
Container Namespace & Cgroup Confinement Review Prompt
Review a container's runtime confinement — namespaces, cgroups, capabilities, user mapping, and mounts — to reduce the host attack surface and prevent a compromised container from escaping or exhausting resources.
- Claude
- ChatGPT
Open prompt - Intermediate
Container Image CVE Remediation Plan Prompt
Turn a noisy container image vulnerability scan into a prioritized, action-ready remediation plan that separates base-image fixes from application-dependency fixes and from unfixable noise.
- Claude
- ChatGPT
Open prompt - Advanced
Outbound Firewall Egress Allowlist Hardening Prompt
Design a default-deny egress firewall policy from observed outbound traffic, locking down which destinations a host or workload may reach to contain data exfiltration and command-and-control without breaking required dependencies.
- Claude
- ChatGPT
Open prompt - Advanced
Software Supply-Chain SBOM & Provenance Review Prompt
Review a build's SBOM, signing, and provenance against SLSA to find unsigned artifacts, unverified dependencies, and weak build integrity, then plan the controls that make releases tamper-evident.
- Claude
- ChatGPT
Open prompt - Intermediate
TLS Cipher Suite & Protocol Downgrade Audit Prompt
Audit a service's TLS configuration for weak protocol versions, insecure cipher suites, and downgrade/forward-secrecy gaps, and produce a hardened, compatibility-aware cipher policy.
- Claude
- ChatGPT
Open prompt - Advanced
Ubuntu Server CIS Level 1 Remediation Plan Prompt
Convert a CIS Benchmark Level 1 scan of an Ubuntu/Debian server into a safe, sequenced remediation plan that hardens the host without breaking SSH access or running services.
- Claude
- ChatGPT
Open prompt - Advanced
Cosign Bundle Air-Gapped Verification Prompt
Design offline Sigstore verification using cosign bundles and a mirrored trust root so signed images verify in air-gapped clusters with no reachout to Rekor or Fulcio.
- Claude
- ChatGPT
Open prompt - Intermediate
DAST ZAP Baseline Scan Triage Prompt
Triage OWASP ZAP baseline DAST findings — separate real exploitable issues from header noise and scanner artifacts — and turn the keepers into actionable tickets with verification steps.
- Claude
- ChatGPT
- Cursor
Open prompt - Advanced
Envelope Encryption DEK/KEK Architecture Design Prompt
Design an envelope-encryption scheme — per-object data keys wrapped by a KMS-held key-encryption key — with key rotation, caching, and blast-radius limits that survive a key compromise.
- Claude
- ChatGPT
Open prompt - Intermediate
Gitleaks Custom Rules & False-Positive Tuning Prompt
Tune a Gitleaks config — custom rules, allowlists, and entropy thresholds — to catch real secrets while cutting the false positives that train developers to ignore the gate.
- Claude
- ChatGPT
- Cursor
Open prompt - Advanced
SELinux Targeted Policy Troubleshooting Prompt
Diagnose SELinux denials from audit logs and produce minimal, least-privilege policy fixes — booleans, file contexts, or scoped custom modules — instead of disabling enforcement.
- Claude
- ChatGPT
Open prompt - Advanced
SLSA Level 3 Hosted-Runner Isolation Review Prompt
Audit a CI build platform against SLSA Build L3 requirements — runner ephemerality, build isolation, and non-falsifiable provenance — and produce the exact gaps to close to reach L3.
- Claude
- ChatGPT
Open prompt - Advanced
SPIFFE JWT-SVID Cross-Trust-Domain Federation Review Prompt
Review SPIRE federation and JWT-SVID validation across trust domains — audience binding, bundle exchange, and short TTLs — so a workload in one domain can authenticate to another safely.
- Claude
- ChatGPT
Open prompt - Advanced
DISA STIG OpenSCAP Remediation Triage Prompt
Triage an OpenSCAP STIG scan — separate true failures from false positives and accepted-risk findings — and produce reviewed remediation with the operational blast radius of each fix called out.
- Claude
- ChatGPT
Open prompt - Intermediate
VEX Statement Authoring from CVE Triage Prompt
Turn manual CVE triage decisions into auditable OpenVEX statements with the correct machine-readable justification so scanners go quiet only when there is real evidence.
- Claude
- ChatGPT
- Cursor
Open prompt - Intermediate
Certificate Transparency Monitoring for Rogue Cert Detection Prompt
Design Certificate Transparency log monitoring that alerts on unauthorized or mis-issued certificates for your domains
- Claude
- ChatGPT
Open prompt - Advanced
Cilium FQDN Egress Allowlist and Hubble Observability Prompt
Design Cilium DNS/FQDN-based egress allowlist policies validated against real Hubble flow data to lock down outbound traffic
- Claude
- ChatGPT
Open prompt - Advanced
DNSSEC and DANE TLSA Validation Hardening Prompt
Review and harden DNSSEC signing and DANE TLSA records so resolvers and TLS clients reject spoofed responses and rogue certificates
- Claude
- ChatGPT
Open prompt - Intermediate
kube-bench and Kubescape Cluster Hardening Scan Review Prompt
Interpret kube-bench and Kubescape findings and produce a prioritized remediation plan for control-plane and node CIS hardening
- Claude
- ChatGPT
Open prompt - Advanced
OCSP and CRL Certificate Revocation Validation Review Prompt
Review TLS clients and services for correct certificate revocation checking via OCSP stapling and CRL distribution points
- Claude
- ChatGPT
Open prompt - Intermediate
OSV-Scanner Reachability-Aware CI Dependency Gate Prompt
Design a CI gate using OSV-Scanner that blocks builds on reachable, fixable vulnerabilities while suppressing unreachable noise
- Claude
- ChatGPT
Open prompt - Advanced
SSRF and Cloud IMDS Metadata Protection Review Prompt
Review services and cloud instances for SSRF exposure to the metadata endpoint and design defenses against credential theft
- Claude
- ChatGPT
Open prompt - Advanced
Tetragon TracingPolicy Runtime Enforcement Review Prompt
Design and review Cilium Tetragon TracingPolicy resources that detect and block malicious kernel-level behavior at runtime
- Claude
- ChatGPT
Open prompt - Intermediate
Wazuh Detection Rule and Decoder Tuning Prompt
Tune Wazuh custom rules and decoders to raise true-positive detection while cutting alert noise across endpoints and servers
- Claude
- ChatGPT
Open prompt - Advanced
CloudTrail Anomaly Hunting Review Prompt
Threat-hunt across AWS CloudTrail events to surface suspicious IAM, persistence, and exfiltration patterns and turn them into detections
- Claude
- ChatGPT
Open prompt - Advanced
Container Escape Attack-Surface Review Prompt
Review container and Kubernetes pod specs for configurations that enable host breakout: privileged mode, host mounts, dangerous capabilities, and exposed host namespaces
- Claude
- ChatGPT
Open prompt - Intermediate
Docker Socket Exposure Audit Prompt
Audit where the Docker daemon socket is exposed — mounted into containers, bound over TCP, or shared with CI — and the root-equivalent risk it creates
- Claude
- ChatGPT
Open prompt - Advanced
etcd Encryption and Access Hardening Review Prompt
Review Kubernetes etcd for encryption-at-rest gaps, weak client/peer mTLS, exposed endpoints, and missing backup-protection controls
- Claude
- ChatGPT
Open prompt - Intermediate
npm Lockfile Supply-Chain Audit Prompt
Review a package-lock.json or pnpm-lock.yaml for supply-chain risk: unpinned versions, suspicious registries, install scripts, and dependency confusion exposure
- Claude
- ChatGPT
Open prompt - Intermediate
S3 Bucket Policy Condition Hardening Review Prompt
Review S3 bucket and access-point policies for over-broad principals, missing TLS/encryption conditions, and confused-deputy exposure
- Claude
- ChatGPT
Open prompt - Intermediate
SSH known_hosts Host-Key Pinning Audit Prompt
Audit SSH client host-key trust: stale known_hosts entries, disabled StrictHostKeyChecking, weak key algorithms, and missing host-key pinning across a fleet
- Claude
- ChatGPT
Open prompt - Intermediate
Terraform Provider Checksum Verification Prompt
Review the Terraform dependency lock file and provider sourcing for missing checksums, unpinned versions, untrusted mirrors, and supply-chain tampering risk
- Claude
- ChatGPT
Open prompt - Beginner
Unattended-Upgrades Patch Coverage Audit Prompt
Audit Debian/Ubuntu unattended-upgrades and dnf-automatic configuration to confirm security patches actually apply and reboots happen safely
- Claude
- ChatGPT
Open prompt - Advanced
Core Dump & Exploit-Mitigation Hardening Review Prompt
Audit a Linux host's memory-safety and exploit-mitigation posture — ASLR, core-dump leakage, ptrace scope, executable-stack and RELRO/PIE coverage — to reduce post-compromise impact and stop secrets leaking via crash dumps.
- Claude
- ChatGPT
Open prompt - Advanced
Kernel Module Signing & Blacklist Hardening Review Prompt
Audit a Linux host's kernel-module trust posture — module signature enforcement, lockdown mode, blacklisted/unused drivers, and writable module paths — to block rootkit loading and shrink kernel attack surface.
- Claude
- ChatGPT
Open prompt - Advanced
LD_PRELOAD & Library-Injection Persistence Audit Prompt
Audit a Linux host for library-injection persistence and hijack risk — LD_PRELOAD, /etc/ld.so.preload, ldconfig path poisoning, and writable RPATH/RUNPATH directories used by privileged binaries.
- Claude
- ChatGPT
Open prompt - Beginner
login.defs, umask & Account-Defaults Hardening Review Prompt
Audit Linux account-creation defaults — login.defs, default umask, password aging, UID/GID ranges, and shell/skeleton settings — so every new and existing account inherits a safe, least-privilege baseline.
- Claude
- ChatGPT
Open prompt - Intermediate
NTP & Time-Sync Security Hardening Review Prompt
Audit a host or fleet's time-synchronization setup (chronyd, systemd-timesyncd, ntpd) for spoofable sources, missing authentication, and drift that breaks TLS, MFA, and log correlation.
- Claude
- ChatGPT
Open prompt - Intermediate
Package Repository & GPG Signing Trust Review Prompt
Audit apt/yum/dnf repository configuration and GPG/key trust to catch unsigned repos, insecure HTTP mirrors, stale or overly broad signing keys, and gaps that allow malicious package injection.
- Claude
- ChatGPT
Open prompt - Intermediate
SSH Agent-Forwarding & Jump-Host Risk Review Prompt
Audit SSH client and server config for risky agent forwarding, unrestricted ProxyJump chains, and key-exposure paths on shared bastions, then replace them with safer ProxyJump/certificate patterns.
- Claude
- ChatGPT
Open prompt - Intermediate
Remote Syslog Forwarding Integrity Review Prompt
Audit rsyslog/journald remote log forwarding for plaintext transport, spoofable sources, gaps that let an attacker tamper with or drop logs, and ensure tamper-evident delivery to a central SIEM.
- Claude
- ChatGPT
Open prompt - Beginner
World-Writable Paths & Mount-Option Hardening Review Prompt
Audit a Linux host for world-writable files, sticky-bit gaps, and missing nosuid/nodev/noexec mount options on /tmp, /var/tmp, /dev/shm and removable media to shrink local privilege-escalation and code-execution surface.
- Claude
- ChatGPT
Open prompt - Advanced
Cilium L7 Network Segmentation Policy Prompt
Design Cilium L3/L4/L7 network policies to enforce least-privilege east-west traffic, including HTTP-method and DNS-aware rules and default-deny baselines.
- Claude
- ChatGPT
Open prompt - Beginner
Dependency Pinning & Lockfile Integrity Prompt
Harden the software supply chain by enforcing pinned, hash-verified dependencies and lockfile integrity across language ecosystems to block tampering and unexpected upgrades.
- Claude
- Copilot
Open prompt - Intermediate
Distroless & Minimal Base Image Migration Prompt
Plan a migration of container images to distroless or minimal bases to shrink attack surface, remove shells and package managers, and cut CVE noise without breaking runtime.
- Claude
- Copilot
Open prompt - Intermediate
AWS GuardDuty Threat-Detection Tuning Prompt
Tune AWS GuardDuty findings to reduce noise, enable the right data sources, and route high-severity threats to actionable response without alert fatigue.
- Claude
- ChatGPT
Open prompt - Intermediate
Just-in-Time Privileged Access Design Prompt
Design a just-in-time, time-bound privileged access model that replaces standing admin rights with approval-gated, fully audited elevation for humans and pipelines.
- Claude
- Cursor
Open prompt - Advanced
Kubernetes Secret Encryption-at-Rest with KMS Prompt
Design encryption at rest for Kubernetes Secrets in etcd using a KMS provider, with envelope encryption, key rotation, and verification that existing secrets get re-encrypted.
- Claude
- Gemini
Open prompt - Advanced
PCI-DSS Cardholder Data Environment Scoping Prompt
Define and minimize PCI-DSS scope by mapping cardholder data flows, identifying connected systems, and recommending segmentation to shrink the CDE and audit burden.
- Claude
- ChatGPT
Open prompt - Intermediate
Trivy & Grype Scan Policy Gate Design Prompt
Design a CI vulnerability-scanning gate using Trivy and Grype with severity thresholds, ignore policies, and exception governance so builds fail safely on known CVEs.
- Claude
- ChatGPT
Open prompt - Advanced
Vault Audit Device & Lease Governance Prompt
Design HashiCorp Vault audit logging, lease and TTL governance, and token lifecycle controls so secret access is fully traceable and short-lived by default.
- Claude
- ChatGPT
Open prompt - Intermediate
Cloud-Init & Instance Bootstrap Hardening Prompt
Audit and harden cloud-init / user-data bootstrap scripts that provision new VM instances — eliminate plaintext secrets, unverified downloads, and over-permissive first-boot configuration.
- Claude
- ChatGPT
Open prompt - Advanced
Data Exfiltration & DLP Controls Design Prompt
Design layered controls that detect and prevent sensitive-data exfiltration — DLP policies, egress monitoring, and access guardrails — without crippling legitimate workflows.
- Claude
- ChatGPT
Open prompt - Advanced
Detection-as-Code Testing & Coverage Prompt
Build a detection-as-code workflow that version-controls, unit-tests, and measures coverage for SIEM/EDR detection rules so blue-team logic ships with the same rigor as application code.
- Claude
- ChatGPT
Open prompt - Beginner
Email Authentication SPF/DKIM/DMARC Hardening Prompt
Audit and harden a domain's email authentication — SPF, DKIM, and DMARC — to stop spoofing and phishing that impersonate your organization, then drive DMARC to an enforcing policy safely.
- Claude
- ChatGPT
Open prompt - Intermediate
Golden Image Pipeline Hardening Prompt
Harden the build pipeline that produces golden VM images (AMIs/Packer templates) — provenance, hardening baselines, vulnerability gates, and signing — so every instance starts from a trusted, minimal base.
- Claude
- ChatGPT
Open prompt - Intermediate
Helm Chart Security Review Prompt
Review a Helm chart and its values for insecure Kubernetes defaults — privileged containers, missing securityContext, hostPath mounts, and risky RBAC — before it ships to a shared cluster.
- Claude
- ChatGPT
Open prompt - Advanced
Honeypot & Deception Grid Design Prompt
Design a defensive deception layer — honeypots, honeytokens, and decoy credentials — that generates high-fidelity intrusion signals without expanding real attack surface.
- Claude
- ChatGPT
Open prompt - Advanced
OAuth2 / OIDC Token Security Review Prompt
Review an OAuth2 / OpenID Connect integration for token-handling weaknesses — flow choice, scope creep, token storage, validation, and refresh — that lead to account takeover or token theft.
- Claude
- ChatGPT
Open prompt - Intermediate
Terraform State Security Review Prompt
Review how Terraform/OpenTofu state is stored, encrypted, locked, and accessed — state files routinely contain plaintext secrets and full infrastructure topology, making them a high-value target.
- Claude
- ChatGPT
Open prompt - Advanced
Cloud Landing Zone Guardrails Review Prompt
Review or design preventive and detective guardrails for a multi-account cloud landing zone — SCPs/org policies, baseline config rules, region/service restrictions, and account vending defaults.
- Claude
- ChatGPT
Open prompt - Intermediate
Content Security Policy Design & Review Prompt
Author and tighten a Content-Security-Policy for a web app — kill XSS injection vectors, remove unsafe-inline/unsafe-eval, add nonces/hashes, and roll out via report-only without breaking the page.
- Claude
- ChatGPT
Open prompt - Intermediate
Database Security Hardening Review Prompt
Audit and harden a production database (PostgreSQL/MySQL/MongoDB) — authentication, network exposure, encryption, least-privilege grants, and audit logging — without breaking applications.
- Claude
- ChatGPT
Open prompt - Intermediate
Git Commit Signing & Verification Rollout Prompt
Design a rollout for signed Git commits and tags — GPG vs SSH vs Sigstore gitsign keys, key custody, branch-protection verification, and CI enforcement — across a developer org.
- Claude
- ChatGPT
Open prompt - Intermediate
Rate Limiting & DDoS Resilience Design Prompt
Design layered rate-limiting and abuse-protection defenses for an API or web app — edge/L7 limits, per-identity quotas, bot mitigation, and graceful degradation — to absorb floods without harming real users.
- Claude
- ChatGPT
Open prompt - Advanced
Service Mesh Authorization Policy Review Prompt
Author and review Istio/Linkerd authorization policies — default-deny service-to-service access, identity-based AuthorizationPolicy rules, and JWT/request-level scoping — without breaking traffic.
- Claude
- ChatGPT
Open prompt - Advanced
SIEM Detection Rule Engineering Review Prompt
Review and tune SIEM detection rules — reduce false positives, map coverage to MITRE ATT&CK, add context for triage, and codify detection-as-code with testing — for a blue-team SOC.
- Claude
- ChatGPT
Open prompt - Intermediate
Vulnerability & Patch Management Lifecycle Design Prompt
Design a defensible patch and vulnerability-management lifecycle — asset inventory, scanner intake, risk-based SLAs, patch windows, exception handling, and metrics — across servers and containers.
- Claude
- ChatGPT
Open prompt - Intermediate
Backup & Ransomware Resilience Hardening Review Prompt
Audit your backup and recovery posture against ransomware — immutability, air-gap/offline copies, isolated credentials, and tested restores — so an attacker who owns prod can't also destroy your recovery path.
- Claude
- ChatGPT
Open prompt - Intermediate
Break-Glass Privileged Access Workflow Design Prompt
Design a just-in-time, audited break-glass procedure for emergency privileged access — time-boxed elevation, approval, full session recording, and automatic revocation — so admins aren't sitting on standing root.
- Claude
- ChatGPT
Open prompt - Advanced
Container Runtime Sandbox Isolation Review Prompt
Evaluate and design stronger workload isolation — gVisor, Kata Containers, microVMs, and user namespaces — for multi-tenant or untrusted-code workloads where shared-kernel containers aren't enough.
- Claude
- ChatGPT
Open prompt - Advanced
Internal PKI & Certificate Lifecycle Design Prompt
Design a private PKI for internal services — CA hierarchy, HSM-backed roots, automated issuance and rotation via cert-manager/Vault, and revocation — so certificates never expire unexpectedly or outlive trust.
- Claude
- ChatGPT
Open prompt - Intermediate
Kubernetes NetworkPolicy Authoring & Review Prompt
Move a Kubernetes cluster from flat, open pod networking to default-deny, least-privilege NetworkPolicies — author, review, and validate ingress/egress rules per workload without breaking traffic.
- Claude
- ChatGPT
Open prompt - Advanced
Seccomp & AppArmor Profile Design Prompt
Build tight seccomp and AppArmor/SELinux profiles that shrink a container's kernel attack surface — restricting syscalls, file paths, and capabilities to only what the workload provably needs.
- Claude
- ChatGPT
Open prompt - Advanced
SLSA Build Provenance Attestation Design Prompt
Raise your build pipeline up the SLSA levels — generate, sign, and verify tamper-evident build provenance so consumers can prove an artifact came from your source via your hardened builder.
- Claude
- ChatGPT
Open prompt - Advanced
SPIFFE/SPIRE Workload Identity Federation Prompt
Design a SPIFFE/SPIRE deployment that issues short-lived, cryptographic workload identities (SVIDs) across clusters, clouds, and bare metal — replacing long-lived secrets with attested, federated identity.
- Claude
- ChatGPT
Open prompt - Intermediate
STRIDE Threat Modeling Workshop Prompt
Run a structured STRIDE threat-modeling session on a system design — decompose data flows, enumerate threats per trust boundary, rank by risk, and produce prioritized, testable mitigations.
- Claude
- ChatGPT
Open prompt - Advanced
Cosign Keyless Image Admission Verification Prompt
Gate Kubernetes admission on Sigstore cosign signatures and attestations — keyless OIDC signing, policy on issuer/identity, and a fail-closed verifyImages rollout that blocks unsigned images.
- Claude
- ChatGPT
Open prompt - Intermediate
CSPM Cloud Misconfiguration Remediation Prompt
Turn a noisy Cloud Security Posture Management backlog (Prowler, Steampipe, Security Hub, Scout Suite) into a risk-ranked, remediation-ready plan with IaC fixes and guardrails that stop regressions.
- Claude
- ChatGPT
Open prompt - Advanced
eBPF Security Observability Design Prompt
Design defensive eBPF-based security observability with Tetragon or Tracee — process, file, and network telemetry mapped to detection use-cases — without crippling production performance.
- Claude
- ChatGPT
Open prompt - Advanced
Falco Runtime Threat-Detection Rules Prompt
Author, tune, and triage Falco runtime-security rules that catch real container/host threats — privilege escalation, reverse shells, crypto-miners, secret reads — without drowning on-call in false positives.
- Claude
- ChatGPT
Open prompt - Intermediate
GitHub Actions OIDC Keyless Cloud Auth Prompt
Replace long-lived cloud access keys in CI with GitHub Actions OIDC federation — trust policies scoped to repo/branch/environment, least-privilege roles, and verification that stolen credentials can't be reused.
- Claude
- ChatGPT
Open prompt - Intermediate
Kyverno Admission Policy Design Prompt
Design, validate, and roll out Kyverno policies for Kubernetes admission control — validate, mutate, generate, and verifyImages — with Audit-first rollout and CEL where it fits.
- Claude
- ChatGPT
Open prompt - Advanced
OPA Rego Policy Authoring & Review Prompt
Write, refactor, and unit-test Open Policy Agent Rego policies for admission control, Terraform plan gating, and API authorization — readable, testable, and fail-closed by default.
- Claude
- ChatGPT
Open prompt - Beginner
Pre-Commit Secret Scanning Gate Prompt
Stop secrets before they reach git — configure pre-commit and CI secret scanners (gitleaks, detect-secrets, trufflehog) with a baseline, tuned rules, and developer-friendly remediation that doesn't get bypassed.
- Claude
- ChatGPT
Open prompt - Advanced
HashiCorp Vault Dynamic Secrets Design Prompt
Design short-lived, dynamic secrets in HashiCorp Vault — database, cloud, and PKI engines — with auth methods, lease/TTL strategy, and least-privilege policies that replace long-lived static credentials.
- Claude
- ChatGPT
Open prompt - Advanced
CI/CD Pipeline Supply-Chain Hardening Prompt
Harden a CI/CD pipeline against supply-chain attacks — pinned and least-privilege actions/runners, OIDC deploy auth, artifact signing and provenance (SLSA), and protected branches/environments.
- Claude
- ChatGPT
Open prompt - Intermediate
Cloud Storage Public-Exposure Audit Prompt
Audit object storage (S3, GCS, Azure Blob) for public exposure — bucket policies, ACLs, account-level blocks, and access logging — and produce safe remediation that won't break legitimate access.
- Claude
- ChatGPT
Open prompt - Intermediate
Encryption-at-Rest & KMS Key Policy Review Prompt
Review encryption-at-rest coverage and KMS key policies — find unencrypted data stores, over-broad key grants, missing rotation, and weak key separation — then tighten without losing access to data.
- Claude
- ChatGPT
Open prompt - Intermediate
Terraform / IaC Misconfiguration Scan Triage Prompt
Triage and remediate findings from tfsec, Checkov, or Trivy IaC scans across Terraform/CloudFormation — separate real risk from noise, write fixes, and add policy-as-code guardrails.
- Claude
- ChatGPT
Open prompt - Advanced
Incident Forensic Logging Readiness Review Prompt
Assess whether your logging and telemetry would actually support a security investigation — coverage, retention, integrity, and time-sync — and close the gaps before an incident, not during one.
- Claude
- ChatGPT
Open prompt - Advanced
Kubernetes RBAC Least-Privilege Review Prompt
Audit Kubernetes RBAC — Roles, ClusterRoles, bindings, and ServiceAccounts — to find overly broad grants, dangerous verbs, and privilege-escalation paths, then tighten to least privilege.
- Claude
- ChatGPT
Open prompt - Advanced
Secrets Management Architecture Design Prompt
Design a centralized secrets-management architecture (Vault or cloud secret manager) — storage, dynamic credentials, access policy, injection, rotation, and break-glass — for an existing stack.
- Claude
- ChatGPT
Open prompt - Intermediate
WAF & OWASP Rule Tuning Review Prompt
Review and tune a Web Application Firewall (ModSecurity/CRS, AWS WAF, Cloudflare) — cut false positives, close coverage gaps against the OWASP Top 10, and roll out rules safely in count-then-block mode.
- Claude
- ChatGPT
Open prompt - Advanced
Workload Identity & Service Account Hardening Prompt
Harden how non-human workloads authenticate to cloud and Kubernetes — replace long-lived keys with federated/workload identity, scope service accounts tightly, and kill standing credentials.
- Claude
- ChatGPT
Open prompt - Intermediate
Audit & Logging Policy Design Prompt
Design a defensible audit-logging policy — what security events to capture, tamper-resistant retention, and high-value detection signals — so you can answer 'who did what, when' during an incident.
- Claude
- ChatGPT
Open prompt - Advanced
auditd Rule-Set Design Prompt
Design a focused, low-noise Linux auditd rule-set that captures the events that actually matter for forensics and compliance without drowning the audit log in irrelevant syscalls.
- Claude
- ChatGPT
Open prompt - Intermediate
Bastion / Jump-Host Hardening Review Prompt
Review a bastion/jump host for excess exposure and weak controls, then harden it into a minimal, heavily logged, single-purpose gateway with session recording and tight forwarding rules.
- Claude
- ChatGPT
Open prompt - Advanced
CIS Benchmark Compliance Assessment Prompt
Interpret CIS Benchmark scan results for Linux hosts or Kubernetes, prioritize the findings that matter, and produce safe remediation with rollback — without breaking workloads chasing a perfect score.
- Claude
- ChatGPT
Open prompt - Advanced
Cloud IAM Privilege-Escalation Path Review Prompt
Audit cloud IAM for privilege-escalation paths and missing permission boundaries — finding the chained permissions that let a low-privilege identity become admin — and harden them.
- Claude
- ChatGPT
Open prompt - Intermediate
Container Image Vulnerability Scan Triage Prompt
Turn noisy Trivy/Grype container image scan output into a prioritized, actionable remediation plan — separating reachable, fixable CVEs from base-image noise and false positives.
- Claude
- ChatGPT
Open prompt - Intermediate
Dependency CVE Triage & Prioritization Prompt
Turn a noisy dependency vulnerability scan into a ranked, actionable remediation plan using reachability, exploitability, and exposure — instead of chasing every red CVE.
- Claude
- ChatGPT
Open prompt - Intermediate
DNS Security & Resolver Hardening Review Prompt
Review DNS posture for DNSSEC validation gaps, open/recursive resolver exposure, and missing encrypted transport, then harden resolvers and zones against spoofing and exfiltration.
- Claude
- ChatGPT
Open prompt - Advanced
Egress Filtering & Outbound Control Policy Prompt
Design a default-deny egress policy that controls outbound traffic from servers and clusters — allowlisting required destinations, proxying egress, and detecting exfiltration and C2 beaconing.
- Claude
- ChatGPT
Open prompt - Intermediate
fail2ban Brute-Force Protection Tuning Prompt
Review and tune fail2ban jails to stop credential-stuffing and brute-force attempts without locking out legitimate users, with sane bantimes, allowlists, and persistent banning.
- Claude
- ChatGPT
Open prompt - Intermediate
File Integrity Monitoring with AIDE/Tripwire Prompt
Design and tune a file integrity monitoring deployment (AIDE or Tripwire) that detects tampering of critical files while staying quiet about expected churn like logs, caches, and package updates.
- Claude
- ChatGPT
Open prompt - Intermediate
Firewall & Network Egress Hardening Review Prompt
Audit and tighten host and cloud firewall rules — nftables/iptables, security groups, NACLs — toward default-deny ingress and controlled egress, eliminating overly broad 0.0.0.0/0 exposure.
- Claude
- ChatGPT
Open prompt - Advanced
Kubernetes Pod Security Standards Review Prompt
Review a Kubernetes cluster's workloads against the Pod Security Standards (baseline/restricted) and produce a phased enforcement plan that won't break running apps.
- Claude
- ChatGPT
Open prompt - Advanced
Kernel Lockdown & Secure Boot Hardening Prompt
Review and harden a Linux host's boot-chain integrity — Secure Boot, kernel lockdown mode, and module signing — so unsigned or malicious code cannot load into the kernel.
- Claude
- ChatGPT
Open prompt - Advanced
Least-Privilege IAM Policy Review Prompt
Right-size over-permissioned cloud IAM — strip wildcard actions, scope resources, eliminate privilege-escalation paths, and replace static keys with short-lived roles, using actual usage data.
- Claude
- ChatGPT
Open prompt - Advanced
mTLS Service-to-Service Authentication Design Prompt
Design mutual-TLS authentication between internal services — certificate issuance, rotation, trust domains, and enforcement — so workloads prove identity to each other under a default-deny model.
- Claude
- ChatGPT
Open prompt - Advanced
nftables Firewall Ruleset Review & Rewrite Prompt
Audit a messy iptables/nftables ruleset for gaps, shadowed rules, and default-allow leaks, then produce a clean, default-deny nftables rewrite with stateful tracking and logging.
- Claude
- ChatGPT
Open prompt - Intermediate
PAM & MFA Authentication Policy Review Prompt
Review a Linux host's PAM stack and multi-factor configuration to close authentication gaps — weak password policy, missing MFA, lockout bypasses, and dangerous module ordering.
- Claude
- ChatGPT
Open prompt - Beginner
Reverse-Proxy Security Headers Audit Prompt
Audit a reverse proxy (nginx, Caddy, HAProxy, Traefik) for missing or weak HTTP security headers — CSP, HSTS, frame/content-type protections — and produce a hardened, app-aware configuration.
- Claude
- ChatGPT
Open prompt - Beginner
Risky Shell Command & Script Review Prompt
Review shell commands, scripts, and pasted one-liners for destructive or unsafe behavior before running them — flagging data loss, privilege misuse, and remote-pipe-to-shell patterns.
- Claude
- ChatGPT
Open prompt - Advanced
Rootkit & IOC Detection Triage Prompt
Run a structured, defensive triage of a possibly-compromised Linux host — checking for rootkits and indicators of compromise — and decide between false alarm, contain, or full incident response.
- Claude
- ChatGPT
Open prompt - Advanced
SBOM & Sigstore Supply-Chain Verification Prompt
Stand up artifact provenance and signature verification — generate SBOMs, sign with Sigstore/cosign, attach SLSA provenance, and enforce admission policies that reject unsigned or untrusted builds.
- Claude
- ChatGPT
Open prompt - Intermediate
Secrets-in-Git History Scanning & Remediation Prompt
Scan a Git repository's full history for leaked secrets and produce a correct remediation plan — rotate first, then purge history and prevent recurrence — without the usual mistakes.
- Claude
- ChatGPT
Open prompt - Intermediate
Secrets Rotation Runbook Builder Prompt
Design safe, zero-downtime rotation procedures for credentials, API keys, and certificates — covering dual-key overlap, blast-radius mapping, and verification, including emergency rotation after a leak.
- Claude
- ChatGPT
Open prompt - Intermediate
SOC2 & CIS Evidence-Gathering Automation Prompt
Design automation that continuously collects, timestamps, and stores audit evidence mapped to SOC2 and CIS controls — replacing the last-minute screenshot scramble before an audit.
- Claude
- ChatGPT
Open prompt - Advanced
SSH Certificate Authority Access Design Prompt
Design an SSH CA-based access model that replaces sprawling authorized_keys with short-lived signed certificates, principals-based authorization, and clean revocation.
- Claude
- ChatGPT
Open prompt - Intermediate
TLS & Certificate Hardening Review Prompt
Audit TLS configuration and certificate lifecycle across endpoints — protocol/cipher selection, cert chain and expiry, OCSP/HSTS, and mTLS — to close weak-crypto and expired-cert exposure.
- Claude
- ChatGPT
Open prompt - Intermediate
WireGuard VPN Hardening Review Prompt
Review a WireGuard (or legacy VPN) configuration for weak peer scoping, over-broad AllowedIPs, missing key rotation, and routing leaks, then harden it to least-privilege access.
- Claude
- ChatGPT
Open prompt - Advanced
Zero-Trust Micro-Segmentation Planning Prompt
Plan network micro-segmentation toward a zero-trust model — map flows, define identity-based segments, and design enforcement with default-deny east-west policies.
- Claude
- ChatGPT
Open prompt - Intermediate
CI/CD Secret Exposure Review Prompt
Audit GitHub Actions, GitLab CI, CircleCI, or Jenkins pipelines for secret leaks — logged secrets, exfiltration via unscoped tokens, third-party action risks.
- Claude
- ChatGPT
- Cursor
Open prompt - Beginner
Dockerfile Security Review Prompt
AI security review of a Dockerfile — privilege, attack surface, secrets in layers, vulnerable bases, supply-chain risk.
- Claude
- ChatGPT
- Cursor
Open prompt - Intermediate
Linux Server Hardening Prompt
Walk an AI through a CIS-style hardening review of a Linux server — services, users, SSH, kernel parameters, file permissions — with safe, ordered remediation.
- Claude
- ChatGPT
Open prompt - Beginner
SSH Security Audit Prompt
Audit sshd_config, authorized_keys, and SSH client config — flag insecure defaults, weak algorithms, missing controls.
- Claude
- ChatGPT
Open prompt - Intermediate
Sudoers & Systemd Services Review Prompt
AI review of /etc/sudoers (and /etc/sudoers.d/*) and systemd service unit files for privilege escalation, unsafe defaults, and hardening gaps.
- Claude
- ChatGPT
Open prompt
Guides
- · 9 min read
Security Error Guide: 'dh key too small' TLS Handshake Failure After Hardening
Fix TLS 'dh key too small' / 'sslv3 alert handshake failure': diagnose weak Diffie-Hellman parameters and SECLEVEL after hardening, regenerate DH params, and verify with openssl.
Read guide - · 9 min read
SSL_ERROR_BAD_CERT_DOMAIN: Certificate Name Mismatch — Cause and Fix
Fix SSL_ERROR_BAD_CERT_DOMAIN and ERR_CERT_COMMON_NAME_INVALID: diagnose missing SAN entries, wildcard scope, SNI default-vhost fallback, and Ingress host mismatches with openssl.
Read guide - · 9 min read
Security Error Guide: 'audit: backlog limit exceeded' Audit Event Loss
Fix auditd 'backlog limit exceeded' and lost audit events: diagnose kernel queue overflow, too-broad rules, slow disk, and tune backlog_limit, rate_limit, and failure mode safely.
Read guide - · 8 min read
auditd Error: 'The audit system is in immutable mode, no rule changes allowed' — Cause, Fix, and Troubleshooting Guide
Fix auditctl 'audit system is in immutable mode, no rule changes allowed' (-e 2): rules are locked until reboot. Edit persistent rules and reboot.
Read guide - · 8 min read
chage Error: 'chage: cannot change to shadow password aging information' — Cause, Fix, and Troubleshooting Guide
Fix chage 'cannot change to shadow password aging information': missing shadow entry, LDAP/SSSD accounts, or a locked shadow database. Diagnose and fix.
Read guide - · 8 min read
Fail2ban Error: 'Failed to access socket path' — Cause, Fix, and Troubleshooting Guide
Fix fail2ban 'Failed to access socket path: /var/run/fail2ban/fail2ban.sock': the server is down, the run dir is missing, or a stale socket blocks startup.
Read guide - · 8 min read
GPG Error: 'gpg: keyserver receive failed: No data' — Cause, Fix, and Troubleshooting Guide
Fix 'gpg: keyserver receive failed' (No data / timed out / server failure): switch keyservers, fix dirmngr and proxies, or import keys directly.
Read guide - · 8 min read
GPG Error: 'gpg: signing failed: Inappropriate ioctl for device' — Cause, Fix, and Troubleshooting Guide
Fix 'gpg: signing failed: Inappropriate ioctl for device': gpg-agent has no tty to prompt. Set GPG_TTY, use loopback pinentry, or a headless agent.
Read guide - · 8 min read
nftables Error: 'nft: Error: Could not process rule: No such file or directory' — Cause, Fix, and Troubleshooting Guide
Fix nft 'Could not process rule: No such file or directory': missing table/chain, unloaded kernel module, or wrong family. Diagnose and build rulesets safely.
Read guide - · 8 min read
OpenSSL Error: 'unable to load Private Key' — Cause, Fix, and Troubleshooting Guide
Fix OpenSSL 'unable to load Private Key' (PEM routines / no start line / bad decrypt): wrong format, encrypted key, corrupt PEM, or a cert-key mismatch.
Read guide - · 8 min read
PAM Error: 'pam_unix(sshd:auth): authentication failure' — Cause, Fix, and Troubleshooting Guide
Fix 'pam_unix(sshd:auth): authentication failure' in auth.log: read rhost/user fields, tell brute-force from expired/locked accounts, and harden auth.
Read guide - · 8 min read
passwd Error: 'Authentication token manipulation error' — Cause, Fix, and Troubleshooting Guide
Fix 'passwd: Authentication token manipulation error': read-only /etc, missing/immutable shadow, full disk, or a network account. Diagnose and fix.
Read guide - · 8 min read
setcap Error: 'Failed to set capabilities on file: Operation not supported' — Cause, Fix, and Troubleshooting Guide
Fix setcap 'Failed to set capabilities ... Operation not supported': the filesystem lacks xattr support (overlay/NFS/tmpfs). Diagnose and fix.
Read guide - · 8 min read
SELinux Error: 'setenforce: SELinux is disabled' — Cause, Fix, and Troubleshooting Guide
Fix 'setenforce: SELinux is disabled': you cannot enforce at runtime when SELinux is disabled in config. Re-enable via /etc/selinux/config, relabel, reboot.
Read guide - · 8 min read
ssh-agent Error: 'Could not open a connection to your authentication agent' — Cause, Fix, and Troubleshooting Guide
Fix 'Could not open a connection to your authentication agent': ssh-agent is not running or SSH_AUTH_SOCK is unset/stale. Start the agent and export the socket.
Read guide - · 8 min read
SSH Error: 'Load key: invalid format' — Cause, Fix, and Troubleshooting Guide
Fix SSH 'Load key: invalid format': corrupt key, PuTTY .ppk vs OpenSSH, CRLF line endings, or a public key used as the private key. Diagnose and fix.
Read guide - · 8 min read
SSHD Error: 'Authentication refused: bad ownership or modes for file' — Cause, Fix, and Troubleshooting Guide
Fix sshd 'Authentication refused: bad ownership or modes for file': StrictModes rejects group/world-writable home, .ssh, or authorized_keys. Fix perms.
Read guide - · 8 min read
SSHD Error: 'sshd: no hostkeys available -- exiting' — Cause, Fix, and Troubleshooting Guide
Fix 'sshd: no hostkeys available -- exiting': missing/unreadable host keys, wrong HostKey paths, or bad permissions. Regenerate keys and restart sshd safely.
Read guide - · 8 min read
Sudo Error: 'sudo: no tty present and no askpass program specified' — Cause, Fix, and Troubleshooting Guide
Fix 'sudo: no tty present and no askpass program specified' in cron, CI, and remote SSH: use NOPASSWD sudoers, -S with stdin, or SUDO_ASKPASS the right way.
Read guide - · 8 min read
UFW Error: 'ERROR: problem running ufw-init' — Cause, Fix, and Troubleshooting Guide
Fix ufw 'ERROR: problem running ufw-init': nftables/Docker backend conflicts, missing iptables modules, or bad rules. Diagnose and reset safely.
Read guide - · 9 min read
Security Error Guide: cosign 'no matching signatures' Verification Failed
Fix cosign 'no matching signatures' errors: diagnose wrong keys, missing signatures, identity/issuer mismatches, and Rekor/TUF failures, and verify container image signatures correctly.
Read guide - · 9 min read
Security Error Guide: etcd 'remote error: tls: bad certificate' (mTLS)
Fix etcd 'remote error: tls: bad certificate' mTLS failures: diagnose missing or wrong client certs, CA mismatches, and expiry, and connect etcdctl securely without disabling TLS.
Read guide - · 9 min read
Security Error Guide: Kubernetes 'admission webhook denied' Pod Security
Fix Kubernetes admission-webhook denials from Pod Security Standards, Kyverno, or Gatekeeper: read the denial, find the failing control, and fix the pod spec securely.
Read guide - · 9 min read
Security Error Guide: LUKS 'No key available with this passphrase'
Fix LUKS unlock failures: diagnose 'No key available with this passphrase', check key slots and headers, recover with a backup keyslot or header, and avoid destroying encrypted data.
Read guide - · 8 min read
Security Error Guide: npm EINTEGRITY 'sha512 integrity checksum failed'
Fix npm EINTEGRITY integrity checksum errors: understand lockfile integrity hashes, distinguish cache/registry issues from tampering, and resolve without disabling verification.
Read guide - · 9 min read
Security Error Guide: OpenSSL 'certificate revoked' (OCSP/CRL Revocation)
Fix 'certificate revoked' errors: check OCSP and CRL status with OpenSSL, confirm a real revocation vs. stale data, replace the cert, and harden revocation checking.
Read guide - · 9 min read
Security Error Guide: seccomp Blocked Syscall (Operation Not Permitted)
Fix seccomp-blocked syscalls in containers: read the SCMP_ACT_ERRNO denial, find the missing syscall with strace and audit logs, and add it to a least-privilege profile.
Read guide - · 8 min read
Security Error Guide: SSH 'Too many authentication failures'
Fix SSH 'Too many authentication failures': stop the agent offering every key, use IdentitiesOnly and IdentityFile, and tune MaxAuthTries without weakening server security.
Read guide - · 9 min read
Kubernetes RBAC Error: 'Forbidden: User cannot list resource' Access Denied
Fix Kubernetes 'Forbidden: User cannot list resource' RBAC denials: read the error, map it to Roles and RoleBindings, and grant least-privilege access without over-granting cluster-admin.
Read guide - · 9 min read
mTLS Error: 'tls: bad certificate' Client Authentication Rejected
Fix mTLS 'tls: bad certificate' and 'certificate required' handshake failures: diagnose missing client certs, untrusted CAs, expiry, and SAN mismatch, then harden mutual TLS correctly.
Read guide - · 9 min read
SSH Error: 'Permission denied (publickey)' Key Authentication Failure
Fix SSH 'Permission denied (publickey)': diagnose key mismatch, wrong user, authorized_keys permissions, and sshd policy with verbose logging, then harden key-only auth safely.
Read guide - · 9 min read
Security Error Guide: JWT 'invalid signature' / signature verification failed
Fix JWT 'invalid signature' and 'signature verification failed': diagnose wrong key, algorithm mismatch, key rotation/kid, encoding, and clock/claim confusion.
Read guide - · 9 min read
Security Error Guide: 'x509: certificate is valid for X, not Y' Hostname Mismatch
Fix TLS 'certificate is valid for X, not Y' and 'certificate name does not match': diagnose SAN gaps, wrong SNI, missing subjectAltName, and split-horizon DNS.
Read guide - · 9 min read
Security Error Guide: 'fapolicyd: deny ... Operation not permitted' Blocked Execution
Fix fapolicyd execution denials: diagnose 'Operation not permitted' on binaries and scripts, read the fapolicyd log, trust files correctly, and add scoped allow rules safely.
Read guide - · 9 min read
Security Error Guide: 'firewalld COMMAND_FAILED' iptables Rule Apply Failure
Fix firewalld 'COMMAND_FAILED' / 'INVALID_RULE' errors: diagnose nftables vs iptables backend conflicts, bad direct rules, missing kernel modules, and reload firewalld safely.
Read guide - · 9 min read
Security Error Guide: 'GPG error: ... NO_PUBKEY' Repository Signature Verification Failed
Fix apt/yum GPG signature verification failures: diagnose NO_PUBKEY, expired repo keys, missing keyrings, and BADSIG errors, then verify and install keys the right way.
Read guide - · 9 min read
Security Error Guide: 'pam_faillock: Account locked due to failed logins'
Fix pam_faillock account lockouts: diagnose accumulated failed logins, audit deny thresholds, reset faillock counters safely, and tune lockout policy after hardening.
Read guide - · 9 min read
Security Error Guide: 'no matching host key type found' After SSH Hardening
Fix SSH 'no matching host key type found' and key-exchange failures after disabling weak algorithms: diagnose ssh-rsa removal, missing KexAlgorithms overlap, and HostKeyAlgorithms.
Read guide - · 9 min read
Security Error Guide: 'user is not in the sudoers file' Privilege Escalation Failure
Fix sudo 'is not in the sudoers file' and 'a password is required' errors: diagnose missing group membership, broken sudoers.d drop-ins, and locked-down privilege escalation.
Read guide - · 9 min read
Security Error Guide: 'Read-only file system' After systemd ProtectSystem Hardening
Fix systemd 'Read-only file system' and namespace errors after ProtectSystem/ProtectHome sandboxing: diagnose blocked writes, add ReadWritePaths, and harden a service safely.
Read guide - · 11 min read
Offline Sigstore: Verifying Signed Images in Air-Gapped Clusters With Cosign Bundles
Capture cosign bundles at build time and mirror the Sigstore trust root so signed images verify in disconnected clusters with zero reachout to Fulcio or Rekor.
Read guide - · 11 min read
Envelope Encryption in Practice: DEKs, KEKs, and Containing a Key Compromise
Design field-level envelope encryption on a cloud KMS — per-object data keys wrapped by a KMS key, with rotation, caching, and blast-radius limits that survive a leak.
Read guide - · 10 min read
Tuning Gitleaks for Precision: A Secret Scanner Developers Won't Bypass
Cut Gitleaks false positives with custom rules, scoped allowlists, and entropy tuning so the gate catches real secrets without training developers to ignore or disable it.
Read guide - · 11 min read
STIG Hardening Without Locking Yourself Out: An OpenSCAP Remediation Workflow
Triage OpenSCAP STIG findings by blast radius, stage SSH and auth fixes safely, and document the deviations auditors accept instead of blindly applying SCAP fix content.
Read guide - · 11 min read
Wiring VEX Into CI: Authoring OpenVEX Statements That Auditors Trust
Generate, review, and attach OpenVEX statements in a pipeline so scanner suppressions carry a real justification, survive re-verification, and never silence a finding on vibes.
Read guide - · 9 min read
TLS & Security Error Guide: 'apparmor="DENIED"' (AppArmor Profile Block)
Fix AppArmor DENIED errors: read apparmor=DENIED in dmesg/journalctl, identify the profile and operation, add file/network rules, and reload with apparmor_parser.
Read guide - · 9 min read
TLS & Security Error Guide: 'curl: (60) SSL certificate problem'
Fix curl error 60 SSL certificate problem: diagnose missing chain, untrusted CA, hostname mismatch, expired cert, and wrong CA bundle without using --insecure.
Read guide - · 9 min read
TLS & Security Error Guide: 'Host key verification failed' (SSH known_hosts)
Fix SSH 'Host key verification failed': diagnose changed/rotated host keys, stale known_hosts entries, IP vs hostname mismatch, and verify fingerprints safely.
Read guide - · 10 min read
TLS & Security Error Guide: 'SELinux is preventing ...' (AVC Denial)
Fix SELinux AVC denials: read avc: denied messages with ausearch and sealert, correct file contexts, ports, and booleans, then build a targeted policy module.
Read guide - · 10 min read
TLS & Security Error Guide: 'tls: handshake failure' / no cipher suites in common
Fix TLS handshake failure and 'no cipher suites in common': diagnose protocol-version mismatch, cipher/curve overlap, missing key type, and SNI/cert config.
Read guide - · 9 min read
TLS & Security Error Guide: 'unable to get local issuer certificate' (Chain / CA)
Fix 'SSL certificate problem: unable to get local issuer certificate': repair an incomplete chain, missing intermediate, or untrusted CA bundle on the client.
Read guide - · 8 min read
TLS & Security Error Guide: 'UNPROTECTED PRIVATE KEY FILE!' (SSH Key Permissions)
Fix SSH 'Permissions are too open' / UNPROTECTED PRIVATE KEY FILE: set 0600 on keys, fix directory modes and ownership, and resolve bad permissions on the server.
Read guide - · 9 min read
TLS & Security Error Guide: 'x509: certificate has expired or is not yet valid'
Fix the x509 certificate expired/not-yet-valid TLS error: check notBefore/notAfter dates, clock skew, intermediate expiry, and renew or replace the cert chain.
Read guide - · 9 min read
TLS & Security Error Guide: 'x509: certificate signed by unknown authority'
Fix 'x509: certificate signed by unknown authority': install a private CA, repair an incomplete chain, refresh the trust store, or mount CA bundles in containers.
Read guide - · 10 min read
Fixing SELinux Denials Without Setting Permissive: A Least-Privilege Approach
Decode SELinux AVC denials and resolve them with file contexts, booleans, or scoped modules instead of disabling enforcement, keeping containment intact in production.
Read guide - · 11 min read
Reaching SLSA Build Level 3: Ephemeral Runners and Provenance You Can't Forge
What SLSA Build L3 actually requires — runner ephemerality, build isolation, and non-falsifiable provenance — and how to assess your CI honestly instead of overclaiming a level.
Read guide - · 11 min read
SPIFFE Federation Done Safely: JWT-SVIDs Across Trust Domains
Federate SPIRE trust domains without opening a confused-deputy hole — bind the JWT-SVID audience, validate the federated bundle, and know when X.509 mTLS is the safer choice.
Read guide - · 10 min read
DAST in CI Without the Noise: Triaging OWASP ZAP Baseline Findings
Wire a ZAP baseline scan into CI and triage its output by exploitability and exposure, separating real findings from header noise so the gate is actionable instead of ignored.
Read guide - · 9 min read
Auditing CORS Configuration with AI Before It Leaks Your API
A wildcard origin with credentials is an open door. Here's how I use AI to audit CORS policies for reflected origins, credential leaks, and over-broad allowlists.
Read guide - · 10 min read
Endpoint Visibility with osquery and AI-Assisted Triage
osquery turns your fleet into a database you can ask questions of. Here's how I use AI to write defensive detection queries and triage the results without drowning in rows.
Read guide - · 11 min read
Hardening JWT Validation: An AI-Assisted Review of the Footguns
JWTs fail open in quiet ways. Here's how I use AI as a fast junior reviewer to catch alg confusion, skipped signature checks, and missing claim validation before they ship.
Read guide - · 10 min read
Hardening Rate Limiting and Abuse Controls With AI-Assisted Review
Credential stuffing and enumeration don't trip a WAF. Here's how I use AI to design and audit application-layer rate limits and abuse controls that actually slow attackers.
Read guide - · 10 min read
Redacting Secrets and PII From Logs With AI-Assisted Review
Logs leak more than you think: tokens, emails, card fragments. Here's how I use AI to audit logging code and build redaction patterns before sensitive data hits disk.
Read guide - · 11 min read
Reviewing Cloud Security Group Rules With AI Before They Open the World
0.0.0.0/0 on the wrong port is a breach waiting to happen. Here's how I use AI to audit AWS, GCP, and Azure firewall rules for over-broad ingress and stale openings.
Read guide - · 11 min read
Reviewing Kubernetes NetworkPolicy for Default-Deny With AI
A flat cluster network is one compromised pod away from full lateral movement. Here's how I use AI to audit NetworkPolicies toward default-deny without breaking traffic.
Read guide - · 10 min read
Sandboxing Linux Services With Landlock and AI-Assisted Review
Landlock lets a process drop its own filesystem access at runtime. Here's how I use AI to scope a least-privilege sandbox and review the rules before they ship.
Read guide - · 11 min read
Writing Sigma Detection Rules with AI Without Drowning in False Positives
Sigma is portable detection-as-code for your SIEM. Here's how I use AI to draft rules, tune out noise, and map fields to my log schema, with a human verifying every rule.
Read guide - · 11 min read
AI-Assisted Threat Modeling With STRIDE That Teams Actually Finish
Use STRIDE and an LLM to threat model systems fast, turning enumerated threats into mitigations and tickets without the design review process stalling out.
Read guide - · 10 min read
Canary Tokens: Catching Intruders With Bait They Can't Resist
Canary tokens and honeytokens turn an attacker's curiosity into an early-warning alarm. Here's how I plant fake creds and decoy files to detect breaches fast.
Read guide - · 10 min read
DNS Egress Filtering: Closing the Exfiltration Channel Everyone Forgets
Lock down outbound name resolution: force DNS through a resolver, allowlist egress domains, log queries, and detect DNS tunneling and C2 before data leaves.
Read guide - · 11 min read
From SBOM to VEX: Suppressing Unexploitable CVEs With Evidence, Not Vibes
Use VEX and OpenVEX to mark CVEs not_affected with a real justification, cut scanner noise, attach VEX to images, and catch SBOM drift before you ship.
Read guide - · 10 min read
Hardening HTTP Security Headers and CSP Without Breaking Your App
A practical guide to hardening HTTP security headers and rolling out a Content-Security-Policy from report-only to enforced, with Caddy and edge worker config.
Read guide - · 11 min read
Hardening Redis and Postgres Against the Internet (and Your Own Network)
Lock down Redis and PostgreSQL: binding, requirepass, ACLs, TLS, pg_hba least privilege, scram-sha-256, and finding exposed instances before attackers do.
Read guide - · 10 min read
Hardening WireGuard for a Zero-Trust Mesh, Not a Flat Network
Harden WireGuard with least-privilege AllowedIPs, key rotation, preshared keys, and host firewalls so your mesh becomes a zero-trust network, not a flat one.
Read guide - · 11 min read
Ransomware-Resilient Backups: Immutability and Recovery Drills That Actually Work
Build immutable, air-gapped backups with S3 Object Lock and restic append-only repos, plus recovery drills and mass-encryption detection to survive ransomware.
Read guide - · 10 min read
Triaging Dependency Vulnerabilities With OSV-Scanner Without Drowning
Scan source lockfiles with OSV-Scanner, triage findings by reachability and fix availability, and suppress non-exploitable noise with VEX to keep CI honest.
Read guide - · 10 min read
AI-Assisted Firewall Rule Reviews for nftables
A firewall ruleset is only as good as your ability to read it. Here's how I use AI to audit nftables rules for overly broad allows, shadowed rules, and default-allow gaps.
Read guide - · 10 min read
AI-Assisted sudoers Least-Privilege Audits That Actually Find Holes
A sloppy sudoers file is a privilege-escalation waiting to happen. Here's how I use AI to audit sudo rules for wildcards, NOPASSWD traps, and GTFOBins-style escape hatches before attackers do.
Read guide - · 11 min read
Auditing GitHub Actions Workflows for Security with AI
CI pipelines run with privileged tokens and pull untrusted code. Here's how I use AI to audit GitHub Actions workflows for injection, token over-scope, and unpinned actions before they ship.
Read guide - · 10 min read
Auditing PAM and Password Policy on Linux with AI
PAM controls who gets in and how. Here's how I use AI to audit pam.d stacks and password policy for weak lockout, missing MFA hooks, and silent authentication bypasses.
Read guide - · 10 min read
Catching Risky Shell Commands Before They Run with AI
Most production disasters start with a single mistyped command. Here's how I use AI as a pre-flight reviewer to flag destructive, irreversible, or scope-creeping shell commands before I hit enter.
Read guide - · 10 min read
Dockerfile Security Review with AI: Catching Footguns Before Build
Most container risk is baked in at build time. Here's how I use AI to review Dockerfiles for root users, leaked secrets, fat images, and unpinned bases before they ever ship.
Read guide - · 11 min read
Finding Public Cloud Exposure with AI: S3 Buckets and IAM
Public buckets and over-broad IAM are the top cloud breach causes. Here's how I use AI to audit S3 policies and IAM grants for accidental public access and wildcard permissions.
Read guide - · 9 min read
Reviewing Linux Kernel sysctl Hardening with AI
Kernel tunables control your network stack, memory, and attack surface. Here's how I use AI to review sysctl hardening settings against CIS guidance without breaking production networking.
Read guide - · 10 min read
Reviewing nginx Security Configuration with AI
Your reverse proxy is your front door. Here's how I use AI to audit nginx configs for weak TLS, leaked version headers, missing security headers, and path-traversal footguns.
Read guide - · 8 min read
Keyless Image Signing with Cosign and Sigstore: Proving What You Deploy
Long-lived signing keys leak. Sigstore's keyless flow ties a signature to an OIDC identity instead. Here's how to sign and verify images for real.
Read guide - · 8 min read
OIDC Keyless Cloud Auth in CI: Killing the Long-Lived Credentials in Your Pipeline
Static cloud keys in CI secrets are the breach waiting to happen. OIDC federation swaps them for short-lived tokens. Here's how to cut them over.
Read guide - · 8 min read
OPA/Gatekeeper vs Kyverno: Choosing a Kubernetes Policy Engine You'll Actually Maintain
Both engines block bad pods at admission time. The real question is which one your team can write, debug, and live with. Here's an honest comparison.
Read guide - · 8 min read
Pod Security Standards in Practice: Hardening Workloads at Admission Time
Most pods run with privileges they never use. Pod Security Standards close that gap. Here's how to enforce restricted profiles without breaking your apps.
Read guide - · 8 min read
Seccomp and AppArmor: Shrinking the Syscall Attack Surface of Your Containers
A container can call hundreds of syscalls it never needs. Seccomp and AppArmor strip that surface down. Here's how to profile and lock down workloads safely.
Read guide - · 8 min read
Service Mesh mTLS: Istio vs Linkerd for Encrypting Everything Between Pods
Plaintext east-west traffic is a gift to an attacker who's already inside. A mesh gives you automatic mTLS. Here's how to roll it out without an outage.
Read guide - · 8 min read
SLSA Supply-Chain Levels: A Practical Roadmap From Zero to Provenance
SLSA is a maturity ladder for build integrity, not a checkbox. Here's what each level actually demands and how to climb it without boiling the ocean.
Read guide - · 8 min read
Stopping Secret Leaks Before They Hit Git History: Scanning the Whole Pipeline
A leaked credential in Git is forever, even after you delete the line. Here's how to block secrets at commit, in CI, and across history with layered scanning.
Read guide - · 8 min read
Writing Custom Falco Rules That Catch Real Attacks (Not Just Noise)
Falco's default rules are a starting point, not a strategy. Here's how to write custom detection rules tuned to your environment without drowning in false positives.
Read guide - · 9 min read
Automating Secrets Rotation Without Taking Down Production
Static credentials that never rotate are a breach waiting to happen. Here's how to automate rotation for database creds, API keys, and certs without a single outage.
Read guide - · 8 min read
Certificate Lifecycle and Internal PKI: Ending the 3 AM Expiry Outage
Expired certs cause more outages than most attacks. Here's how to automate the full certificate lifecycle and run an internal PKI that issues, rotates, and revokes without manual toil.
Read guide - · 9 min read
Compliance as Code: Turning SOC 2 and CIS Evidence Into a Pipeline
Audit season shouldn't mean a month of screenshots. Here's how to express controls as code and generate continuous, queryable compliance evidence for SOC 2 and CIS automatically.
Read guide - · 9 min read
eBPF Security Observability: Seeing What Your Kernel Actually Does
eBPF turns the kernel into a programmable security sensor with near-zero overhead. Here's how to use it for deep visibility into process, network, and file activity without agents.
Read guide - · 9 min read
Hardening the Docker Daemon and Container Runtime: The Host Is the Crown Jewel
A container escape becomes a host takeover when the daemon is wide open. Here's how to harden the Docker daemon, runtime, and container defaults so a breakout goes nowhere.
Read guide - · 9 min read
mTLS and Service Identity with SPIFFE: Giving Every Workload a Real Name
IP allowlists and shared API keys don't survive autoscaling. Here's how to give every workload a cryptographic identity with SPIFFE/SPIRE and enforce mTLS that actually means something.
Read guide - · 9 min read
Runtime Threat Detection with Falco: Catching the Breach as It Happens
Scanning catches bad images before they run. Falco catches bad behavior while they run. Here's how to deploy runtime detection that flags the breach in real time without alert fatigue.
Read guide - · 8 min read
WAF and Rate Limiting: Hardening the Edge Without Breaking Real Users
Your edge takes the first hit from every bot, scraper, and exploit scanner online. Here's how to layer a WAF and rate limiting that stops abuse without false-positiving your customers.
Read guide - · 9 min read
Audit Logging and Threat Detection: Building a Trail You Can Actually Investigate
Logs you can't query are just disk usage. Here's how I build audit logging that survives an incident — auditd, cloud trails, tamper-resistance — and use AI to surface real threats.
Read guide - · 8 min read
Building Least-Privilege IAM Policies Without Breaking Everything
Most IAM policies are wildly over-permissioned because tightening them is scary. Here's how I scope cloud permissions down safely — and use AI to draft and audit least-privilege policies.
Read guide - · 9 min read
CIS Benchmark Hardening for Linux Servers: A Pragmatic Walkthrough
CIS Benchmarks are hundreds of controls deep. Here's how I apply the ones that matter to production Linux, automate the checks, and use AI to interpret findings without breaking servers.
Read guide - · 8 min read
Container Image Scanning Done Right: Triage CVEs Without Drowning in Noise
Image scanners produce hundreds of CVEs and almost no priorities. Here's how I scan with Trivy, fix what matters, and use AI to triage findings into a real action list.
Read guide - · 8 min read
Hardening SSH Access to Production Servers: A Practical Checklist
SSH is the front door to every server you run. Here's how I lock it down — key-only auth, sane ciphers, bastion patterns — and use AI to audit the config without breaking access.
Read guide - · 9 min read
Kubernetes Security Hardening: Pods, RBAC, and Network Policy That Actually Contain a Breach
A default Kubernetes cluster is dangerously permissive. Here's how I harden pods, RBAC, and network policy so one compromised container can't become the whole cluster — with AI auditing the manifests.
Read guide - · 9 min read
Managing Secrets in Production: Vault, Sealed Secrets, and the Patterns That Actually Hold
Secrets in plaintext env files and git repos are how breaches start. Here's how I run Vault and Sealed Secrets in production — plus how AI helps audit for leaked credentials.
Read guide - · 9 min read
Securing Your CI/CD Pipeline: Locking Down the Most Attacked Surface You Own
Your CI/CD pipeline has more production access than most engineers. Here's how I harden runners, scope tokens, and pin actions — plus using AI to audit pipeline config for risk.
Read guide - · 9 min read
Software Supply Chain Security: SBOMs, Signing, and Knowing What You Ship
You can't secure software you can't inventory. Here's how I generate SBOMs, sign artifacts with Sigstore, verify provenance, and use AI to make supply-chain data actionable.
Read guide - · 11 min read
DevOps Security Best Practices Every Engineering Team Should Follow
Security isn't a separate department's job — it's a daily engineering discipline. Here's the practical, blue-team checklist every DevOps team should build into their workflow.
Read guide - · 7 min read
Securing AI-Generated Bash Scripts Before You Run Them
AI writes bash quickly and confidently. It also writes bash that destroys filesystems, exposes secrets, and silently swallows errors. Here's the checklist before you run anything an AI wrote.
Read guide
Recommended tools
-
Gemma
by Google DeepMind
4.4Open-weights LLM family that runs locally — for air-gapped ops, on-prem inference, and privacy-sensitive infrastructure work.
- Best for
- Air-gapped incident response, on-prem log analysis, cost-controlled bulk processing
- Pricing
- Free — open weights under Gemma terms of use; commercial use permitted
Read review -
Amazon Q Developer
by Amazon Web Services
4.3AWS's AI assistant for building and operating on AWS — IaC, CLI, and resource Q&A grounded in your account.
- Best for
- Building & operating on AWS — CloudFormation/CDK/Terraform, CLI, and AWS resource troubleshooting
- Pricing
- Free tier (generous); Pro $19/user/mo
Read review -
Microsoft Copilot for Azure
by Microsoft
4.0An AI assistant inside the Azure portal that knows your environment — generate Bicep/CLI, troubleshoot AKS, and query Log Analytics in plain English.
- Best for
- Managing & troubleshooting Azure resources, generating Bicep/CLI, AKS diagnostics, KQL authoring
- Pricing
- Included with Azure at no additional charge (standard Azure resource usage applies)
Read review