RivasSec

Infrastructure. Security. Insight.

Field notes on infrastructure security, cloud hardening, Kubernetes, IAM, and OSINT by RivasSec.

Bandit-Clean Pwnagotchi Plugins: How `subprocess` Goes From Risk to Routine

Posted on Wed 10 June 2026 in DevSecOps • 9 min read

pwnagotchi
python
bandit
subprocess
security
supply-chain
hardening

Hardening a Pwnagotchi plugin against Bandit B602/B603/B607: shutil.which() full paths, argv-list calls, input validation, and the nosec discipline.

Hardening Kubernetes Deployments

Posted on Sat 19 April 2025 in Kubernetes Security • 2 min read

kubernetes
hardening
devsecops

Pod-level Kubernetes guardrails aligned with the Pod Security Standards Restricted profile: non-root, no caps, read-only FS, NetworkPolicies, SA hardening.

Taming the OOM Killer: Process Priorities on Linux

Posted on Fri 18 April 2025 in DevSecOps • 3 min read

linux
oom-killer
sysadmin
hardening
devsecops

The Linux OOM Killer decides what dies under memory pressure. Protect sshd, mysqld, and other critical processes with oom_score_adj via a small script.