13462 shaares
338 private links
338 private links
- Audit, pin and fetch the dependencies
- Disable install-time and build-time scripts
- Secure-by-design architecture: design for evolution, principle of least privilege, data minimization
- Runtime hardening: drop privileges with landlock: For that I use the landlock crate to allowlist the very few files and directories touched by my services.
- Use KMS with envelope encryption instead of a secret manager
- Minimal containers and virtual machines
