SecureConfig.ai

Guide index

102 guides in 12 categories

Every guide is a Markdown file in the repository, read on GitHub or fetched raw by an assistant. Jump to a category, then open a guide; most guides record the sources checked and, where known, the exact versions.

Scope

The guides cover deployment exposure: TLS, human and machine authentication, MFA, access restrictions, secrets, and inbound and outbound network access, from first deployment through teardown. General application security, including injection, deserialization, and business logic flaws, belongs to the OWASP resources linked throughout the guides. Each guide stays in the repository on GitHub; this site holds the index, the rules for assistants, the tasks, and the checklist.

At a glance

102guides
12categories
11verification checks

Categories

5 guides

Certificates and tunnels

10 guides

Identity, authentication, and secrets

6 guides

Web servers and proxies

9 guides

Languages and frameworks

5 guides

Containers and Kubernetes

4 guides

Hosts and cloud platforms

24 guides

Databases, storage, and messaging

  • postgresql (opens in a new tab)PostgreSQL: server TLS, SCRAM authentication, pg_hba rules, verified client connections, runtime-vs-owner privilege separation, restricted CONNECT and schema CREATE, secure search_path, and connection/DDL audit logging
  • connection-poolers (opens in a new tab)PgBouncer and pgpool-II: client TLS that is off by default, a server hop that falls back to plaintext, and the pg_hba rules a pooler stops matching
  • mysql (opens in a new tab)MySQL and MariaDB: required TLS transport, per-user TLS, modern auth plugins, scoped least-privilege accounts, anonymous/test/remote-root cleanup, local_infile and secure_file_priv restrictions, and password validation/reuse
  • mongodb (opens in a new tab)MongoDB: requireTLS, authorization, bind address, least-privilege roles with explicit SCRAM-SHA-256, replica/cluster membership auth, per-user source restrictions, and x.509 client identities
  • redis (opens in a new tab)Redis: TLS, requirepass, bind/protected-mode, and least-privilege ACLs with durable rules, key/channel scoping, and runtime command lockdown
  • sqlite (opens in a new tab)SQLite in deployment, the file is the exposure; Turso tokens; Litestream
  • sqlite-http-frontends (opens in a new tab)Datasette and sqlite-web: SQLite HTTP exposure, loopback binding, authentication, TLS, and verification
  • surrealdb (opens in a new tab)SurrealDB, root credentials, bind address, access levels, TLS
  • time-series-metrics-stores (opens in a new tab)InfluxDB, VictoriaMetrics, and QuestDB: default-off auth, default credentials, and fronting
  • elasticsearch (opens in a new tab)Elasticsearch and OpenSearch: keep built-in security on, scoped roles and API keys, anonymous/CORS lockdown, audit logging
  • clickhouse (opens in a new tab)ClickHouse: user passwords, secure ports, network restrictions, SQL-driven RBAC with table-scoped roles, query/memory limits and quotas, external-source restrictions, and protected query/session logs
  • neo4j (opens in a new tab)Neo4j: initial password, Bolt and HTTPS TLS, auth stays on, scoped Enterprise roles with label/property grants, procedure/function/load denials, transaction memory and timeout limits, and security-event logging
  • memcached (opens in a new tab)Memcached: no auth by default; private binding and UDP off, dedicated unprivileged account, connection and item-memory limits, disabled cache-wide flush and key enumeration, SASL and TLS where built in
  • search-engines (opens in a new tab)Meilisearch and Typesense, master key, scoped search keys, production mode
  • minio (opens in a new tab)MinIO (AIStor): root and scoped credentials, TLS, server-side encryption, object locking, and audit logging
  • object-storage (opens in a new tab)S3, R2, GCS, Azure Blob, Supabase Storage: private by default, scoped credentials, signed URLs
  • firebase-supabase (opens in a new tab)Firebase rules and Supabase RLS: ownership rules across Firestore/RTDB/Storage, Data-API and key hygiene, function/Storage/Realtime authorization, App Check, and signup controls
  • supabase-self-hosted (opens in a new tab)The self-hosted Docker stack: replace the demo keys and dashboard password, keep the published ports private
  • pocketbase (opens in a new tab)PocketBase and Appwrite: API and collection rules are the security, plus auth-record and file-field protection, operator and console lockdown, settings encryption, rate limits, and hostname and upload controls
  • headless-cms-instant-api (opens in a new tab)Strapi, Directus, Hasura, and PostgREST: one control gates the whole datastore
  • rabbitmq (opens in a new tab)RabbitMQ: users and permissions, TLS listener, guest account, vhost isolation and resource limits, management HTTPS, monitoring/admin role separation, concrete private bindings, and safe definitions import
  • mosquitto (opens in a new tab)Mosquitto (MQTT): per-device credentials, TLS listener, mutual TLS, topic ACLs with $SYS isolation, connection/packet/queue limits, per-listener scoping, bridge security, and runtime hardening
  • kafka (opens in a new tab)Apache Kafka: SASL_SSL listeners, SCRAM credentials, ACLs, client/replication/controller listener separation, per-role least-privilege ACLs, user quotas and connection limits, and authorization audit logging
  • nats (opens in a new tab)NATS and JetStream, auth, TLS, and the unauthenticated monitoring port

14 guides

AI and agent infrastructure

9 guides

App UIs and dev tools

7 guides

Dashboards and admin consoles

4 guides

Web application controls

5 guides

Exposure and deployment operations

Reference

Reference files