Infrastructure Security

Server hardening, secrets discipline and guardrails that hold when someone is moving fast.

How I use it

A server exposed by default
Restricted access paths, key-based authentication and intrusion prevention as part of provisioning rather than a hardening pass scheduled for later.
Secrets ending up in a repository
Credentials kept out of version control with permissions enforced on the host, and rotation that is possible rather than theoretical.
A destructive command one keystroke away
Automated guardrails that refuse irreversible operations outright — dropping data, removing volumes, editing live configuration by hand — with tests proving the guards still fire. A documented rule is advisory; a hook is not.
A domain anyone can send mail as
DMARC enforcement with SPF and DKIM aligned, monitored over time. Mail authentication is a deliverability control and an anti-spoofing control in the same record.

Want the detail behind any of this?

I can walk through any of it in as much depth as you want.