SectionGuides
Hands-on hardening and response playbooks.
Hardening a Personal Linux Server in an Afternoon
A fresh Debian or Ubuntu server can be locked down in one afternoon with standard tools. This guide covers key-only SSH, a…
How to Put a Self-Hosted Service Behind SSO and Intrusion Blocking in an Afternoon
This guide walks through placing a reverse proxy in front of your self-hosted apps, enforcing single sign-on with two-factor authentication, and automatically…
Hardening a Self-Hosted Web Service Behind a Reverse Proxy with Zero-Trust Access
Learn how to put a self-hosted app behind a reverse proxy with automatic TLS, add single sign-on with MFA in front of…
How to Set Up an SSH Certificate Authority for Your Home Lab in an Afternoon
Replace scattered authorized_keys files with one OpenSSH certificate authority that issues short-lived user and host certificates. This guide walks through a working…
Build a Segmented Home Lab Behind WireGuard: VLANs, Firewall Rules, and Remote Access
Set up a WireGuard VPN, split IoT and server traffic onto separate VLANs, and write default-deny nftables rules. You finish with remote…
Locking Down AI Agent Tool Permissions: A Least-Privilege Setup in an Afternoon
Limit what a tool-using AI agent can do if it is tricked by prompt injection or misused. You will build an allowlisted…
Build a Hardened Self-Hosted WireGuard VPN with Private DNS in an Afternoon
Set up WireGuard for remote access without exposing your services, add per-peer key rotation and firewall rules that limit reach to the…
Hardening a Home Lab: Segment Your Network and Reach Services Only Over WireGuard
Split a flat home network into VLANs, put a default-deny firewall between the segments, and make WireGuard the only way in from…
Build a Hardened Home-Lab WireGuard VPN with Split DNS and Ad and Malware Blocking
Deploy WireGuard on a small Linux server, lock it down with key-only access and a default-deny firewall, and route client DNS through…
Introducing SECBORN Tools: a free CVE Tracker and Exposure Scanner
Two new free tools on SECBORN: a CVE Tracker that scores and ranks every vulnerability we cover, and a Website Exposure Scanner…
Managing Context Windows in Large Codebases
A practical guide to feeding big codebases to an AI model without drowning it in tokens, using retrieval, summarization, compaction, and sub-agents.
Proxmox cloudflared Configuration for the Home Lab
A practical guide to running Cloudflare Tunnel (cloudflared) on Proxmox so you can reach home lab services securely without opening inbound firewall…