# RivasSec | DevSecOps, Kubernetes, AWS IAM

> DevSecOps, cloud, and platform security notes by Oliver Rivas. Threat-model-driven writing on AWS, Kubernetes, IAM, hardening, and incident retrospectives.

Curated index for language models. Full URL list: https://rivassec.com/sitemap.xml

## Posts
- [The DevSecOps Guide: Hardening, IAM, and Incident Response](https://rivassec.com/devsecops-guide.html): A hub for the DevSecOps writing on rivassec.com: IAM blast radius, TLS, incident response, and controls that hold up in production.
- [When the Output Carries the Signal: Claude, SynthID-Text, and the New Detection Attack Surface](https://rivassec.com/claude-synthid-text-watermark-attack-surface.html): Claude's SynthID-Text watermark lives in token selection rather than hidden characters, reshaping detection, scrubbing, spoofing, and enterprise misuse.
- [IAM Blast Radius Is an Architecture Problem, Not a Policy Problem](https://rivassec.com/iam-blast-radius-architecture-problem.html): Most IAM reviews start too late, after the account structure and trust boundaries are set. Least privilege isn't fewer actions; it's smaller failure domains.
- [The Discovery Layer Is Broken: Hiring as an Observability Problem](https://rivassec.com/hiring-discovery-layer-broken.html): The senior engineering market has a routing failure, not a talent shortage: resumes and funnels index for keywords and discard the signal seniors depend on.
- [Prompt Injection Will Become a Supply Chain Evasion Technique](https://rivassec.com/prompt-injection-supply-chain-evasion.html): Prompt injection's threat model is older than the term. The mechanism is new, the objective is the evasion goal attackers have pursued for decades.
- [Bandit-Clean Pwnagotchi Plugins: How `subprocess` Goes From Risk to Routine](https://rivassec.com/pwnagotchi-plugin-bandit-hardening.html): Hardening a Pwnagotchi plugin against Bandit B602/B603/B607: shutil.which() full paths, argv-list calls, input validation, and the nosec discipline.
- [TLS Has Three Jobs. Forget the Rest.](https://rivassec.com/tls-three-jobs.html): TLS gets easier when you stop walking the handshake and name what it's for. It does three jobs; anchor those and it becomes design, not memorization.
- [Adoption Is a Security Control: Notes from Paving a Road](https://rivassec.com/paved-road-adoption-as-control.html): A control developers route around isn't a control. Field notes on making the secure path the easy path: 40% less remediation time, 27% less pipeline latency.
- [The Teensy That Failed in Public: An EFI Brute Force, Hours Late](https://rivassec.com/teensy-efi-bruteforce-hours-late.html): In 2013 Hackaday called my MacBook EFI brute force a failure; hours later it worked. Three rate-limiting defenses, each leaking at a different seam.
- [IAM Roles That Fail Loud: Small Defaults, Big Difference](https://rivassec.com/iam-safe-defaults-fail-loud.html): A small Pulumi library that treats IAM safety as a precondition: mandatory permissions boundary, no wildcard trust, no wildcard actions, every opt-out explicit.
- [The Trust Decay: Why Modern Hiring Has Become an Adversarial System](https://rivassec.com/trust-decay-adversarial-hiring.html): The tech hiring pipeline has shifted from talent discovery to risk mitigation. In 2026, the engineers who get hired are the ones who are hardest to doubt.
- [Never Lose Connection: Multi-Phone Bluetooth Tethering for Pwnagotchi](https://rivassec.com/pwnagotchi-bluetooth-tethering.html): bt-tether-multi is a Pwnagotchi plugin for intelligent multi-phone Bluetooth tethering with automatic WAN failover and silent-disconnect recovery in the field.
- [Elasticsearch Snapshot Verification, Minimal Privileges](https://rivassec.com/elasticsearch-secure-snapshot-verification.html): Verify Elasticsearch snapshots without manage_snapshot: minimal API key, Prometheus-friendly script, and a public tools repo for hardened monitoring automation.
- [Hardening Kubernetes Deployments](https://rivassec.com/hardening-k8s.html): Pod-level Kubernetes guardrails aligned with the Pod Security Standards Restricted profile: non-root, no caps, read-only FS, NetworkPolicies, SA hardening.
- [Taming the OOM Killer: Process Priorities on Linux](https://rivassec.com/oom-killer-process-prioritization.html): The Linux OOM Killer decides what dies under memory pressure. Protect sshd, mysqld, and other critical processes with oom_score_adj via a small script.
- [Catching a Nation-State Proxy: OSINT on Twitter](https://rivassec.com/venezuela-twitter-proxy-osint.html): In 2012 I traced a state-aligned Twitter proxy tied to Venezuela's ruling party. OSINT lessons for spotting subtle, credential-phishing nation-state infra.
- [The 208.5-Day Kernel Bug: Uptime, Overflow, and Risk](https://rivassec.com/208-day-kernel-bug-lessons.html): A 2012 Linux kernel bug caused CPU lockups after 208.5 days of uptime due to an integer overflow in sched_clock(). RHEL 5/6 lesson: patch and observe uptime.
- [The 2012 Leap Second: When Time Broke Java and the Cloud](https://rivassec.com/leap-second-chaos-2012.html): The 2012 leap second broke Reddit, Yelp, Java apps, and more. A retrospective on how fragile timekeeping bit the cloud, and what SRE teams should do today.
## Key pages
- [About RivasSec](https://rivassec.com/pages/about.html)
- [DevSecOps Guide](https://rivassec.com/devsecops-guide.html)