How to Self-Host SearXNG: A Private Metasearch Engine with HTTPS
A step-by-step SearXNG setup using CapRover, with complete configuration files, password protection, HTTPS, search checks, and troubleshooting.
Latest
What Breaks on GrapheneOS (and What Doesn't): The Honest Compatibility Guide
Banking apps, Google Wallet, Android Auto, games, battery — a scannable works/breaks reference for GrapheneOS in 2026, the named apps that block it, why, and the workarounds that actually help.
Notable Security News & Advisories
A maintained reference of critical vulnerabilities, security incidents, and industry shifts covered on this site. Organized by year. Each entry has the essential facts, current status, and what to do about it. 2026 CVE-2026-24061 — GNU InetUtils telnetd Authentication Bypass (February 2026) Severity: 9.8 Critical · Status: Patched in
DarkSword iOS Exploit: Is Your iPhone Still Vulnerable?
Six iOS flaws chained in JavaScript gave attackers root on an iPhone from one page load. The code is public. Here is how to check your exposure.
VPN Industry 2026: Who Owns What, Who Can You Trust
One company now owns four of the most-advertised VPN brands and just went fully private — no more public filings. Here's what the VPN industry actually looks like in 2026, and the questions worth asking before you hand a provider your traffic.
How to Sync Ghost Members to Kit Using n8n (No Zapier Needed)
Ghost removed its native Kit integration. Zapier's Ghost trigger is broken on self-hosted v5+. Here's how to wire Ghost members directly into Kit using n8n — free, self-hostable, ten minutes.
How to Self-Host n8n on a VPS
A production-ready n8n install on a Linux VPS — Docker Compose with PostgreSQL, nginx reverse proxy, SSL, firewall rules, and correct persistence so nothing breaks on restart.
How to Audit Your Password Manager (And Actually Fix What You Find)
Most people set up a password manager and never open the health reports. Here is the audit that finds the weak, reused and dead credentials still sitting in your vault.
iPhone Privacy Setup Guide (iOS 18 / 2026)
The gap between Apple's privacy marketing and what iOS actually does — and the settings that close it. Covers ADP, Siri data transmission, ATT limits, and the UK ADP removal story.
How to Use Shodan to Find What Your Server Is Leaking
Shodan indexes every open port and service banner on the public internet. Here's how to use it to see what your own servers are exposing — before someone else does.
How to Use theHarvester for OSINT: See What Attackers See Before They Do
theHarvester pulls emails, subdomains, and IPs from public sources in seconds. Run it on your own domain and you might not like what you find.
How to Self-Host Vaultwarden: Your Own Bitwarden Server on a VPS
Vaultwarden is an unofficial Bitwarden-compatible server written in Rust. Run it on a $5 VPS and your passwords never touch someone else's infrastructure.
How to Set Up a YubiKey: Google, GitHub, Bitwarden, and SSH
TOTP and push MFA are bypassed at industrial scale. Hardware keys aren't. Here's which YubiKey to buy and how to set it up on every account that matters.
Guides
How to Set Up a WireGuard VPN Server on Your Own VPS
Running your own WireGuard VPN server means you control what gets logged — nothing, unless you configure it otherwise. The protocol is ~4,000 lines (vs OpenVPN's 70,000+), has been in the Linux kernel since 5.6, and on Ubuntu 22.04 you just install it. This guide
Guides
How to Set Up Email Aliases with SimpleLogin or Addy.io
Email aliases keep your real address out of breach data and spam lists. Here's how to set up SimpleLogin or Addy.io from scratch — first alias, browser extension, catch-all, and which one to actually pick.
Guides
How to Set Up Pi-hole: Network-Wide Ad and Tracker Blocking
Pi-hole blocks ads and trackers for every device on your network at the DNS level. Here's how to set it up on a Raspberry Pi or in Docker.
Guides
How to Set Up a Custom Domain with Proton Mail
Point a domain you own at Proton Mail and your address becomes portable. Here are the five DNS records, in order, with the mistakes that cause silent split delivery.
Guides
How to Harden Nginx: A Practical 2026 Guide
Server tokens, TLS config, security headers, rate limiting, bot blocking , the full Nginx hardening stack with current syntax and the OCSP stapling warning most guides still get wrong.
Guides
How to Set Up Bitwarden: The Complete Guide
Bitwarden's free tier does more than most paid password managers. Here's the complete setup: vault, browser extension, mobile app, 2FA on the vault itself, and an emergency access sheet you'll actually be glad exists.
privacy
How to Configure uBlock Origin: Beyond the Defaults
Most people install uBlock Origin and never touch it again. That leaves a lot of privacy protection on the table. Here's how to configure it properly — filter lists, medium mode, dynamic filtering
Guides
How to Audit Your Browser Extensions
Most people have extensions they installed years ago and haven't thought about since. Here's how to go through them systematically, cut what shouldn't be there, and set up a browser so a compromised extension can't reach what matters.
Guides
First 24 Hours After a Data Breach
A step-by-step order of operations for the first day after a breach notification — what to confirm, what to change, and what genuinely cannot be undone.
Guides
First 24 Hours with GrapheneOS: What to Actually Do After Flashing
You flashed GrapheneOS. Now what? The actual day-one setup sequence, in order — verify, lock screen, the Google Play decision, browser, radio settings, and the permission pass that makes the whole thing worthwhile.
Security
Why MFA Isn't Enough — and What Attackers Do When It Fails
MFA stops most attacks. Not all. Here's what attackers do when they can't beat your second factor — and what actually makes accounts hard to compromise.