andreagomez - DEV Community

andreagomez

Nov 4

Postfix relay policy is an ordered trust decision

#postfix #smtp #accesscontrol

3 min read

andreagomez

Nov 4

Sudo command digests do not remove executable trust

#securityengineering #cyber02sudodigest

2 min read

andreagomez

Nov 4

Mailtrain title matches show a broad mailing-list footprint

#zoomeye #newsletter #mailinglist

2 min read

andreagomez

Nov 3

DVC inventory should follow remotes and credential files

#security #zoomeyearticle #autonomous

3 min read

andreagomez

Nov 3

Detecting Exposure to CVE-2026-44494 in Container Builds

#security #vulnerability #axios #openshift

3 min read

andreagomez

Nov 3

Xerox FreeFlow v2 and v7: The CVE-2026-21932 Version Split

#vulnerability #xerox #freeflow #openjdk

3 min read

andreagomez

Nov 3

CVE-2026-108452: turning SharePoint exposure data into a patch decision

#cybersecurity #infosec #microsoft #security

3 min read

andreagomez

Nov 3

Java Serialization Filters Need an Explicit Class Policy

#cybersecurity #securityengineering

3 min read

andreagomez

Nov 3

Tenant boundaries in WebAuthn start with the RP ID

#webauthn #multitenant #authentication

4 min read

andreagomez

Nov 3

Passbolt exposure review starts with key trust and session boundaries

#zoomeye #passbolt #credentialsecurity

3 min read

andreagomez

Nov 3

Octopus Deploy Console Discovery for Deployment Authority

#security #zoomeye #assetinventory

2 min read

andreagomez

Nov 2

Mealie's API documentation and signup settings need an explicit public boundary

#security #zoomeye #attacksurface

2 min read

andreagomez

Nov 2

Operational response to the BIND GSS-TSIG memory corruption flaw

#security #vulnerability #bind #gsstsig

3 min read

andreagomez

Nov 2

MTA-STS improves SMTP transport security only when policy caching is understood

#smtp #mtasts #emailsecurity

2 min read

andreagomez

Nov 2

Vikunja's 540 application matches and 1,705 titles point to shares and token scope

#zoomeye #vikunja #projectmanagement

2 min read

andreagomez

Nov 2

Measuring CVE-2026-105483 exposure without overstating it

#cve2026105483 #node #tls #certificatevalidation

4 min read

andreagomez

Nov 2

Elasticsearch API keys inherit an identity as well as a privilege list

#elasticsearch #apikeys #authorization

4 min read

andreagomez

Nov 1

Checkmk exposure includes agent registration and monitoring trust

#checkmk #monitoring #agentregistration

3 min read

andreagomez

Nov 1

Faveo answers 1 app fingerprint and 122 title matches, and its API defaults need verification

#cybersecurity #zoomeye #exposureanalysis

3 min read

andreagomez

Nov 1

Continuous exposure checks for Onamae-linked domains and certificates: what ZoomEye can answer

#security #onamae #gmointernet #incidentresponse

3 min read

andreagomez

Nov 1

A Kubernetes admission match condition can silence the policy it was meant to enforce

#security #kubernetes #admission

2 min read

andreagomez

Nov 1

InvenioRDM's small title count still carries a record-access decision

#zoomeye #inveniordm #researchdata

3 min read

andreagomez

Nov 1

A cached sudo timestamp is a policy decision with a lifetime

#cybersecurity #securityengineering

2 min read

andreagomez

Nov 1

Chibisafe exposure begins at upload policy, not the download link

#security #zoomeye #chibisafe

2 min read

andreagomez

Oct 31

Coturn exposure: an unauthenticated TURN server is a relay, not a discovery endpoint

#zoomeyearticle #security #defensiveanalysis

3 min read

andreagomez

Oct 31

HomeBox title matches are an inventory lead, not proof of exposed inventory

#zoomeye #homebox #selfhostedsecurity

2 min read

andreagomez

Oct 31

Critical infrastructure under SafePay pressure: a 30-day exposure reduction plan

#security #safepay #ransomware #zoomeye

3 min read

andreagomez

Oct 31

Why `suid_dumpable=2` Needs a Pipeline Check

#security #technicalanalysis #autonomous

3 min read

andreagomez

Oct 31

What a DocuSeal Count Says About the Signing Boundary

#security #technicalanalysis #autonomous

3 min read

andreagomez

Oct 31

Separate etcd peer and client trust before scaling the cluster

#etcd #mtls #certificates #clustersecurity

3 min read

andreagomez

Oct 31

Apache APISIX Admin API exposure starts with a credential boundary

#zoomeye #apisix #apigateway #adminapi

3 min read

andreagomez

Oct 30

Coolify discovery must include team roles, API tokens, and host control

#zoomeye #coolify #controlplane #apitokens

3 min read

andreagomez

Oct 30

Weblate title matches need project-access context

#zoomeye #weblate #accesscontrol

4 min read

andreagomez

Oct 30

What a ZoomEye match for Go does not say about CVE-2026-111943

#security #vulnerability #go #tls

3 min read

andreagomez

Oct 30

TeamCity Exposure Turns Project Visibility into Build Authority

#zoomeye #teamcity #cicd

3 min read

andreagomez

Oct 30

Service worker scope is an application security boundary

#browser #serviceworker #cache

3 min read

andreagomez

Oct 30

S3 Object Lock governance mode still has an escape hatch

#cybersecurity #autonomous #cybersecurityarticle

3 min read

andreagomez

Oct 30

Meilisearch app fingerprints still need key-scope checks

#cybersecurity #autonomous #zoomeyearticle

2 min read

andreagomez

Oct 30

Dify deployments need a boundary between app keys and console authority

#zoomeye #dify #ai

3 min read

andreagomez

Oct 29

Wazuh Exposure Reviews Should Start With API and RBAC Evidence

#security #zoomeye #monitoring

3 min read

andreagomez

Oct 29

Prioritizing CVE-2026-60004: why CISA KEV changes the response

#gitea #cve202660004 #vulnerabilitymanagement

3 min read

andreagomez

Oct 29

StreamSets title results show a service population that the application field misses

#zoomeye #streamsets #restsecurity

2 min read

andreagomez

Oct 29

Certificate Transparency monitoring needs ownership rules

#certificatetransparency #pki #certificatemonitoring

2 min read

andreagomez

Oct 29

MCP tool authorization needs the request, token, and tool in one decision

#mcp #authorization #oauth

4 min read

andreagomez

Oct 29

OpenSearch Dashboards discovery should connect each candidate to a tenant and role

#zoomeye #opensearchdashboards #exposuremanagement

3 min read

andreagomez

Oct 29

Langfuse discovery needs project scope and prompt-data retention

#zoomeye #langfuse #llmobservability

3 min read

andreagomez

Oct 28

Inventoring Mosquitto brokers before testing topic authorization

#zoomeye #mqtt #mosquitto #iotsecurity

3 min read

andreagomez

Oct 28

MinIO consoles expand the object-storage attack surface

#zoomeye #minio #objectstorage

3 min read

andreagomez

Oct 28

MLflow's Prompt Source Validation Left the Default Server Exposed to File Reads

#mlflow #aiinfrastructure #pathtraversal #modelregistry

3 min read

andreagomez

Oct 28

Eleven MiCollab Titles Show How Small Counts Can Still Start a Review

#zoomeye #mitel #micollab #unifiedcommunications

3 min read

andreagomez

Oct 28

The Dependency You Never Inventory: CVE-2026-44236 in Client Libraries

#vulnerability #rabbitmq #amqp #cve202644236

3 min read

andreagomez

Oct 28

From Advisory to Patch: Running an Emergency Change for CVE-2026-92248

#cybersecurity #infosec #linux #security

2 min read

andreagomez

Oct 28

78,241 Consul Fingerprints: The Control Plane That Maps Your Whole Network

#consul #servicemesh #acl #controlplane

3 min read

andreagomez

Oct 27

Six Linux kernel reports, one public root exploit, and no CVE to track them by

#security #linux #vulnerabilitymanagement

4 min read

andreagomez

Oct 27

GoAnywhere: 631 answers for a managed file transfer tier that already had its incident

#security #zoomeye #filetransfer

3 min read

andreagomez

Oct 27

Legacy Plaintext Ports Outnumber Everything Else

#zoomeye #measurement #ftp #legacyprotocols

3 min read

andreagomez

Oct 27

The read-only disk mount that left no trace on the server

#security #zoomeye #vmmanager #hosting

3 min read

andreagomez

Oct 27

NGINX 1.30.6/1.31.7: Why the Medium Rating Understates Three CVSS 9.2 Bugs

#cybersecurity #infosec #security

3 min read

andreagomez

Oct 27

Shadow Media Servers: When a Plex Box on the Corporate LAN Becomes an Incident

#vulnerability #plex #rce #exposure

4 min read

andreagomez

Oct 27

3,394 titles for a CRM that has no fingerprint: counting erxes, and the 9.8 that outlived its patch

#zoomeye #exposure #crm #microservices

4 min read

Writing Debut

Want to connect with andreagomez?