Hands-on labs in cybersecurity, AI, and observabilityhttps://techwithugur.dev/https://techwithugur.dev/posts/flux-helm-gitops/https://techwithugur.dev/posts/flux-helm-gitops/Every Flux quickstart stops at the happy path. This laptop-sized lab breaks a Helm-based GitOps loop five ways on purpose — plaintext secrets, migration hooks, a broken upgrade, the dreaded stuck release, and manual drift — and shows the exact recovery mechanics for each.Wed, 19 Aug 2026 00:00:00 GMThttps://techwithugur.dev/posts/k8s-appsec-exploit/https://techwithugur.dev/posts/k8s-appsec-exploit/One URL, a throwaway Kubernetes cluster, and only open-source tools. Scan a live app with nuclei, then turn each finding into a stolen SSN, a root shell, a leaked API key, and a crashed pod — every step reproducible on your laptop.Wed, 19 Aug 2026 00:00:00 GMThttps://techwithugur.dev/posts/k8s-appsec-scanning/https://techwithugur.dev/posts/k8s-appsec-scanning/The same vulnerable app from the exploit lab, caught for free — before any of it runs. Gitleaks and Semgrep on the source, Trivy on the build, and a Kyverno gate that refuses to admit the bad image. One command runs the whole gauntlet on your laptop and diffs vulnerable against hardened.Wed, 19 Aug 2026 00:00:00 GMThttps://techwithugur.dev/posts/local-deep-research/https://techwithugur.dev/posts/local-deep-research/OpenAI and Google will run 'deep research' for you in their cloud. This lab builds the miniature version — a LangGraph Deep Agents CLI in TypeScript, driven entirely by a 4B model in Ollama — and documents every trick it takes to make a small local model actually finish the loop.Tue, 18 Aug 2026 00:00:00 GMThttps://techwithugur.dev/posts/css-webmail-exfil/https://techwithugur.dev/posts/css-webmail-exfil/A webmail client that removes every <script> from an email can still hand an attacker your CSRF token — one character at a time — using nothing but CSS. Here's the attack, running locally, and the three-layer fix that stops it.Mon, 17 Aug 2026 00:00:00 GMThttps://techwithugur.dev/posts/supply-chain-egress-sandbox/https://techwithugur.dev/posts/supply-chain-egress-sandbox/A malicious Python package doesn't wait for you to import it — its setup.py runs at pip install time and can ship your credentials out first. Here's a laptop-sized sandbox that lets the install succeed while blocking and naming the leak.Mon, 17 Aug 2026 00:00:00 GMThttps://techwithugur.dev/posts/python-bytecode-blindspot/https://techwithugur.dev/posts/python-bytecode-blindspot/A source-only scanner reads your .py files, but Python runs bytecode — and a shipped .pyc can diverge from its source so the code that executes is not the code you reviewed.Sat, 15 Aug 2026 00:00:00 GMT