diff --git a/CHANGELOG.md b/CHANGELOG.md
index 50b275c8a..6d3c2dec6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ service can change a gate's answer, and a pull request number is only knowable f
## 2026-10-19
+- Fifty guides now open with a short paragraph saying what the tool, service or topic is and what the guide helps an AI assistant secure, followed directly by the AI-assistant prompt and then the versions header (maintainer request, 2026-10-19); the end section keeps a short note linking back to the prompt. Each paragraph was drafted by a worker and reviewed against its guide by two model families; guide bodies are otherwise unchanged. `CONTRIBUTING.md` and the `--intro` help no longer call the paragraph human-written (#705)
- `nodejs.md`, `python.md` and `paas.md`: Railway's listener contract is now cited from its pinned documentation (bind `0.0.0.0` on the injected `PORT`; its edge proxy terminates TLS, and traffic is then forwarded over Railway's internal network to the deployment), and `paas.md`'s redirect bullet links the Railway redirect source inline. Heroku Cedar's listener address, Fly's automatic certificate renewal, the Vercel Functions listener contract and the ACM Private Spaces wildcard question stay open; new TODO rows 1.315 and 1.316 cover two Heroku statements whose cited articles are not yet checked (#704)
- `docker.md`: the secrets rule now cites pinned Docker documentation for environment-variable risks, `env_file`, Compose secrets and Swarm secrets, and reuses Git's v2.49.0 gitignore citation. It describes Compose secrets as files under `/run/secrets/`, supported on Linux containers only, with access granted per service. Swarm secrets are restricted to swarm services; the secrets are encrypted in transit and at rest, accessible to explicitly authorized services while their tasks run, and mounted in memory in Linux containers. The guide's reasoning distinguishes defining a value in `.env` from setting the container environment, with `environment` and `env_file` examples and interpolation elsewhere in Compose. Offering environment files and ignoring or untracking `.env` are labelled as guide advice; the weaker standing of environment files is labelled as guide assessment. The claim retains the history-source limit; TODO 1.296 moves to DONE, and new row 1.314 carries the `workload` claim's `.gitignore` labelling, untracking and rotation follow-up (#703)
- The version-basis tooling supports the next guide layout (maintainer ruling, 2026-10-19): a short introduction paragraph under the title, then the line "If an AI assistant is helping you secure a deployment, give it the prompt below:" with the prompt, then the versions and dates paragraph, then the guide; the end-of-file note shrinks to a short explanation with a link back to the prompt, which now appears once; `tools/version_basis.py --introduce` adds a guide's introduction and checks that nothing else in the guide changes; guides keep validating in the current layout until they move, and no guide changes in this PR (#701)
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index c4614be6e..0fa8cca1e 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -165,7 +165,7 @@ describing the tool, application or service and explaining that this guide helps
AI assistant check that it is configured securely. The generated top block follows that
paragraph: the `ai-assistant-prompt` HTML anchor, the invitation line, the unchanged per-guide
`text` prompt with its raw URL, and the versions/dates header. The intro is ordinary digested
-body text. The rest of the human body and Sources follow the generated top block.
+body text. The rest of the body and Sources follow the generated top block.
The single EOF marker pair wraps the fixed H2 "About the AI assistant section below", a
two-sentence note linking back to the prompt anchor, the summary, and the complete metadata
in a four-backtick `json` fence. The prompt appears only at the top. END is the last non-blank
@@ -205,16 +205,16 @@ metadata, refusing any difference. It never rebinds. Rebuild both bundles and ru
the same change as each migration batch. `--check` and `--write` preserve each guide's layout.
For a two-section guide with its generated block immediately after the H1, run
-`python3 tools/version_basis.py --introduce GUIDE --intro 'One human-written paragraph.'`.
-This accepts the historical form as well as a new top prompt without an intro. It validates
-the original guide, inserts the supplied paragraph, moves the prompt/header below it, shortens
-the EOF note and rebinds the digest. Before writing, it asserts that the new body equals the
-old body with only that paragraph and its two separator LFs inserted after the H1, that no
-other metadata changed, and that the result validates and renders identically. It refuses
-legacy front matter, an existing intro before a top prompt, and invalid or stale inputs.
-Review the intro for meaning; paragraph syntax cannot establish human authorship or accuracy.
-Rebuild both bundles and run the gates for each migration batch. This tooling change delivers
-no guide edits.
+`python3 tools/version_basis.py --introduce GUIDE --intro 'The reviewed intro paragraph.'`.
+Intro paragraphs may be drafted by a worker; each is reviewed against its guide before it is
+applied. This accepts the historical form as well as a new top prompt without an intro. It
+validates the original guide, inserts the supplied paragraph, moves the prompt/header below
+it, shortens the EOF note and rebinds the digest. Before writing, it asserts that the new body
+equals the old body with only that paragraph and its two separator LFs inserted after the H1,
+that no other metadata changed, and that the result validates and renders identically. It
+refuses legacy front matter, an existing intro before a top prompt, and invalid or stale
+inputs. Review the intro for meaning; paragraph syntax cannot establish its accuracy. Rebuild
+both bundles and run the gates for each migration batch.
Schema 1 requires exactly these top-level fields:
diff --git a/VERSION b/VERSION
index 6bd35f476..9bfdbd4b9 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.0.704
+1.0.705
diff --git a/agent-builders.md b/agent-builders.md
index 05743d552..4b9d11336 100644
--- a/agent-builders.md
+++ b/agent-builders.md
@@ -1,5 +1,23 @@
# Agent and workflow builders: Dify, Flowise, Langflow, LibreChat
+Dify, Flowise, Langflow and LibreChat are tools for building AI chatbots, agents and workflows whose flows can run code and call other services. This guide helps your AI assistant configure each securely, including private binds behind TLS, default secrets replaced, MFA from OIDC or a fronting proxy, and contained flows.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/agent-builders.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Dify plugin daemon 0.6.10, Flowise account minimum v3.0.1, Langflow settings source v1.12.6, LibreChat changelog v0.7.7, Docker Compose go.mod v2.24.3, Docker Compose release source v2.24.4, compose-go loader v2.0.0-rc.2, and compose-go reset loader v2.0.0-rc.3; 8 further sources are pinned to a commit and 5 carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 58 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -284,23 +302,7 @@ curl -q -g -sS -L --proto-redir '=https' --noproxy '*' --connect-timeout 5 --max
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/agent-builders.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -398,7 +400,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-19",
"documentation_checked": "2026-09",
- "body_sha256": "d9b3ee77e381107c6cb13fbb56ef6cc80dad8ebcffdf662fb0c82608db2cd8f2",
+ "body_sha256": "0d9ea78e5c061542cfce533e70348b663d5fd6fd199aab9cbbff6a99b0b5cefa",
"components": {
"daemon": {
"name": "Dify plugin daemon",
diff --git a/ai-infra-services.md b/ai-infra-services.md
index df55365ce..dd0674818 100644
--- a/ai-infra-services.md
+++ b/ai-infra-services.md
@@ -1,5 +1,23 @@
# AI infrastructure services: SearxNG, LocalAI, Text Embeddings Inference, LangServe, Mem0, and Onyx
+SearxNG, LocalAI, Text Embeddings Inference, LangServe, Mem0 and Onyx are building blocks for AI apps, from web search to agent memory. This guide helps your AI assistant configure each securely, including authenticated TLS ingress, built-in login or keys enabled where available, and unpublished backing services, apart from deliberate loopback access.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/ai-infra-services.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against SearxNG documentation (no recorded version), TEI HTTP source v1.9.0, Onyx v4.3 source v4.3.13, Onyx v4.4 source v4.4.0, and GNU grep 3.12; 6 further sources are pinned to a commit and 6 carry no recorded version. Metadata reviewed 2026-10-15; documentation checked September 2026. The guide records 47 claims: 1 demonstrated by a check that ran and 46 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -494,23 +512,7 @@ The service facts come from the maintainer's vendor-source verification record d
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/ai-infra-services.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -593,7 +595,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-15",
"documentation_checked": "2026-09",
- "body_sha256": "b9931192e8250b1cb318e09284506c74670be8caecc620df4a16d60b15d8d9a0",
+ "body_sha256": "60945815f4a2fd5042b73043af96642c80d50eb23fc37dd84c49f1bf0656d6fe",
"components": {
"searx": {
"name": "SearxNG documentation",
diff --git a/apache.md b/apache.md
index 6659c4fdd..29424a8f6 100644
--- a/apache.md
+++ b/apache.md
@@ -1,5 +1,23 @@
# Apache HTTP Server: TLS and authentication
+Apache HTTP Server is a web server for serving sites over HTTP and HTTPS. This guide helps your AI assistant make sure it is configured securely: the TLS modules enabled, an HTTPS virtual host configured, HTTP redirected to HTTPS, and authentication required where needed.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/apache.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Apache HTTP Server 2.4, Apache TLSv1.3 minimum 2.4.36+, Apache per-vhost protocol minimum 2.4.42+, Apache chain-file minimum 2.4.8, httpd htpasswd 2.4.69, OpenSSL qualification 1.1.1+, Certbot Apache installation v2.3.0, and Debian apache2 packaging 2.4.69-1, plus 5 more recorded bases; 1 further source carries no recorded version. Metadata reviewed 2026-10-18; documentation checked September 2026. The guide records 20 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -165,23 +183,7 @@ sudo apachectl -S # the vhost list, in Apache's own matchi
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/apache.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -234,7 +236,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-18",
"documentation_checked": "2026-09",
- "body_sha256": "645f3f5ab27a4df2af69e0680ac8e98f85ca416fe85a078c95075598e9b33f4d",
+ "body_sha256": "1337f946ff115e07d47b82d92b16b180220ad1d5cada50672a7a286bf5e4bbd3",
"components": {
"apache": {
"name": "Apache HTTP Server",
diff --git a/chat-uis.md b/chat-uis.md
index ce3ba248b..faf6d8249 100644
--- a/chat-uis.md
+++ b/chat-uis.md
@@ -1,5 +1,23 @@
# Self-hosted chat and agent UIs: AnythingLLM, LobeChat, Chainlit, OpenHands
+AnythingLLM, LobeChat, Chainlit and OpenHands are self-hosted web apps for AI chat and agents. This guide helps your AI assistant configure them securely, including loopback-only ports, LobeChat's registration allowlist, a Chainlit auth callback, and OpenHands reached only through an authenticated tunnel.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/chat-uis.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against AnythingLLM documentation (no recorded version), LobeHub v2.2.16, Docker CLI v27.5.1, Docker Compose v2.32.4, compose-go v2.4.7, Moby v27.5.1, and curl minimum write-out version 7.75.0; 6 further sources carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 30 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -227,23 +245,7 @@ REASONED: preceding block; isolation comparison, listener and external-reachabil
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/chat-uis.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -305,7 +307,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "a8ab396d9c1bb40454583d61e0e4744beaaa5f79069feb09514fede626474e5f",
+ "body_sha256": "a9847336a2a39bf79a5469467afc003a27b16269bf58717e83381db9075457ed",
"components": {
"anything": {
"name": "AnythingLLM documentation",
diff --git a/clickhouse.md b/clickhouse.md
index 54b1e0fc8..68b6fe33e 100644
--- a/clickhouse.md
+++ b/clickhouse.md
@@ -1,5 +1,23 @@
# ClickHouse: listen address, the default user, and TLS ports
+ClickHouse is a database server built for analytical queries over very large tables. This guide helps your AI assistant configure it securely, including a narrow listen address, a password on the default user with real accounts beside it, query limits and quotas, and TLS ports with plaintext ports off.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/clickhouse.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against ClickHouse documentation (no recorded version); 5 further sources are pinned to a commit and 2 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 53 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -687,23 +705,7 @@ SHOW CREATE TABLE system.session_log;
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/clickhouse.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -783,7 +785,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "67374bff4359a86dc344995e032dda6915d16c577426b9a057ca0bf54b0de417",
+ "body_sha256": "14afbfa6b0f58e11e9255aff2b25d80a98cf91b747e75e1d0f4f8bb56ea50474",
"components": {
"docs": {
"name": "ClickHouse documentation",
diff --git a/code-server.md b/code-server.md
index 5ae14b9e0..073f4f092 100644
--- a/code-server.md
+++ b/code-server.md
@@ -1,5 +1,23 @@
# code-server: browser VS Code without giving away the machine
+code-server runs VS Code on a server for use in a browser, and its terminal runs commands on that server. This guide helps your AI assistant configure it securely, including SSH forwarding first, a tailnet or MFA-protected tunnel next, and otherwise a loopback bind behind a TLS proxy adding MFA.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/code-server.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against code-server v4.137.0. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 18 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -118,23 +136,7 @@ REASONED: preceding block; listener inventory, direct-origin isolation, paired e
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/code-server.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -172,7 +174,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "4dfd35a63a16c1e36dc1b89dd972dd12f78009c6ba4876f4a2ef920a7f18bfbe",
+ "body_sha256": "6af52661ed92dd7e53af1386f2ab7b4fc21d17234fed1678687fac88fbef6a48",
"components": {
"server": {
"name": "code-server",
diff --git a/elasticsearch.md b/elasticsearch.md
index 8dc60ed2b..5f8e9f237 100644
--- a/elasticsearch.md
+++ b/elasticsearch.md
@@ -1,5 +1,23 @@
# Elasticsearch and OpenSearch: keep security switched on
+Elasticsearch and OpenSearch are search engines that index documents and logs for searching. This guide helps your AI assistant keep their security switched on, including TLS and authentication, scoped roles, anonymous access off, CORS off unless a browser needs it, and audit logging on OpenSearch or paid Elasticsearch tiers.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/elasticsearch.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Elasticsearch API 8.x, Elasticsearch reference 8.19, Elasticsearch listener source 8.19.22 and 9.5.4, OpenSearch reference 3.6, OpenSearch S3 reference 3.1, OpenSearch S3 source 3.8.0, OpenSearch GCS source 3.8.0, and OpenSearch Azure source 3.8.0, plus 5 more recorded bases; 3 further sources are pinned to a commit and 4 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 65 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -1012,23 +1030,7 @@ REASONED: deployment expectations and source-audit limits recorded in this guide
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/elasticsearch.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -1134,7 +1136,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "b7be20e1e922213f3221d68ed2688b87163c51f827766052d8f533076a1938ab",
+ "body_sha256": "28bc44a107ca57a92533925c4be8dce48e1af9a9ab4a126737a9a91b7fbcd15d",
"components": {
"es-api": {
"name": "Elasticsearch API",
diff --git a/firebase-supabase.md b/firebase-supabase.md
index 46d251875..b3e4a84e1 100644
--- a/firebase-supabase.md
+++ b/firebase-supabase.md
@@ -1,5 +1,23 @@
# Firebase and Supabase: the rules are the security
+Firebase and Supabase are hosted app backends whose database, storage, sign-in and functions are called directly from client code. This guide helps your AI assistant configure each securely, including Firebase Security Rules or Supabase row-level security with grants, separately authorized functions and storage, and server keys kept off clients.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/firebase-supabase.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Firebase documentation (no recorded version), PostgreSQL invoker-view minimum 15, curl curl-8_14_1, and ShellCheck v0.11.0; 2 further sources carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 70 claims: 2 demonstrated by a check that ran and 68 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -957,23 +975,7 @@ REASONED: tool-version provenance for the historical local runs above; the [Shel
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/firebase-supabase.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -1068,7 +1070,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-19",
"documentation_checked": "2026-09",
- "body_sha256": "6690687db9e1d66f3e67a898fc0b030022e55be24166bc29b8c35554e8081891",
+ "body_sha256": "bbf1862c56fcb74db81c1981d8fea7f6d06de5733b616f2c54b21cea041ce073",
"components": {
"firebase": {
"name": "Firebase documentation",
diff --git a/gitops-controllers.md b/gitops-controllers.md
index e1aee0078..2bdb26fc1 100644
--- a/gitops-controllers.md
+++ b/gitops-controllers.md
@@ -1,5 +1,23 @@
# GitOps controllers: Argo CD and Flux
+Argo CD and Flux are GitOps tools: they watch a Git repository and keep a Kubernetes cluster matching it, using whatever permissions they are granted. This guide helps your AI assistant configure each securely, including guarded admin access, reviewed changes to the repositories they deploy, narrow credentials, and restricted egress.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/gitops-controllers.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Argo CD v3.5.3 source (pinned to a commit), Flux OIDC introduction v2.9, Dex source v2.45.1, Redis source 8.2.3, and curl curl-8_14_1; 1 further source is pinned to a commit and 3 carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 50 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -468,23 +486,7 @@ they were not rechecked online. Remaining source limits are identified above.
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/gitops-controllers.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -562,7 +564,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-19",
"documentation_checked": "2026-09",
- "body_sha256": "908b108054ff323b7d30f6ec6652728a0d065571804b124943b579b8f09f77cc",
+ "body_sha256": "290b24b86bba2e9137a85bd45010968f38ebe895865712fb799a2f15553b9f5a",
"components": {
"argo": {
"name": "Argo CD v3.5.3 source",
diff --git a/gradio.md b/gradio.md
index d9f5708bd..ca3562dfe 100644
--- a/gradio.md
+++ b/gradio.md
@@ -1,5 +1,23 @@
# Gradio: launch() authentication and TLS
+Gradio is a Python framework that serves an interactive web app from a script's launch() call. This guide helps your AI assistant make sure an app is configured securely: a login required, TLS in place, public sharing avoided, file access and uploads restricted, and queued work and URL fetching bounded.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/gradio.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Gradio 6.28.0 and Gradio historical fixes 6.16.0 and 6.20.0; 2 further sources carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 53 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -328,23 +346,7 @@ ss -tlnp # With server_port=None, the port search starts at 7860 unless GRADIO
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/gradio.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -421,7 +423,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "b05b85a4144bcb16a146ea0834470b7f5b89ae7edc2bd28e0de73d88d5cc0eb4",
+ "body_sha256": "c44959d1827e9747ad6155b6d85ce94ee5a79954570c23c478db0531c82a0ec1",
"components": {
"gradio": {
"name": "Gradio",
diff --git a/headless-browser-services.md b/headless-browser-services.md
index 450df11da..9cc9c125d 100644
--- a/headless-browser-services.md
+++ b/headless-browser-services.md
@@ -1,5 +1,23 @@
# Headless browser services: Chrome DevTools Protocol, Selenium Grid, browserless, and Playwright server
+Chrome DevTools Protocol, Selenium Grid, browserless and Playwright server let programs control a real browser for testing, scraping or AI agents. This guide helps your AI assistant configure each securely, including automation ports on loopback or a restricted private network, authenticated remote access, limited browser egress, and protected connection URLs.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/headless-browser-services.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Chromium 154.0.8037.57, browserless (open source) 2.56.7, browserless Playwright file-protocol fix 2.51.0, Playwright source v1.58.2, and curl documentation curl-8_14_1; 2 further sources are pinned to a commit and 6 carry no recorded version. Metadata reviewed 2026-10-05; documentation checked October 2026. The guide records 32 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -290,23 +308,7 @@ missing files, authentication failures, connection failures, and timeouts are in
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/headless-browser-services.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -370,7 +372,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-05",
"documentation_checked": "2026-10",
- "body_sha256": "83eb3c90295cb9d91e397cfa9e10e498bcf3591cc59ea0b23a98e47d7021298b",
+ "body_sha256": "ebb4a62836b2de94321149bbe30a946e00bd1e41c808d1c02be928657667b931",
"components": {
"chromium": {
"name": "Chromium",
diff --git a/headless-cms-instant-api.md b/headless-cms-instant-api.md
index af646c72f..4d32ee269 100644
--- a/headless-cms-instant-api.md
+++ b/headless-cms-instant-api.md
@@ -1,5 +1,23 @@
# Instant API backends: Strapi, Directus, Hasura, and PostgREST
+Strapi, Directus, Hasura and PostgREST are backend tools that give apps a generated API over your database. This guide helps your AI assistant configure each securely, including Strapi and Directus admins created privately, Hasura's admin secret set, PostgREST's role grants kept narrow, and secrets kept out of committed files.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/headless-cms-instant-api.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Strapi Users and Permissions source v5.58.0, Directus listener source v12.4.1, Directus quickstart 12.0.2, Hasura quickstart image 2.46.0, Hasura authentication-status minimum 2.48.0, and PostgREST listener source v16.4; 6 further sources carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 48 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -378,23 +396,7 @@ Version boundary at the time of writing: Strapi 5 documentation; current Directu
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/headless-cms-instant-api.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -473,7 +475,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "52cb6bf055f819d9f1a2989a161eea24062bedbbc7b18ba52bab952e739e5d1e",
+ "body_sha256": "1da7b80791f7217c4a2edcee5bab9cf8879fdb6f2675692a32bd1bb94fbc6474",
"components": {
"strapi-signup-source": {
"name": "Strapi Users and Permissions source",
diff --git a/image-gen-uis.md b/image-gen-uis.md
index 9d95f711a..5f76e03cd 100644
--- a/image-gen-uis.md
+++ b/image-gen-uis.md
@@ -1,5 +1,23 @@
# Image-generation UIs: ComfyUI, Stable Diffusion WebUI, InvokeAI, Fooocus
+ComfyUI, Stable Diffusion WebUI, InvokeAI and Fooocus are self-hosted browser apps for creating images with AI models. This guide helps your AI assistant configure each securely, including ports reachable only on host loopback, a tunnel or authenticated TLS proxy in front, Gradio share links off, and hardened containers where used.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/image-gen-uis.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against ComfyUI v0.37.0, AUTOMATIC1111 v1.10.1, Fooocus v2.5.5, Gradio 3.41.2, Docker Engine minimum loopback boundary 28.0, Docker Compose source v2.32.4, and curl minimum write-out version 7.75.0; 1 further source is pinned to a commit and 6 carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 28 claims: 2 demonstrated by a check that ran and 26 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -259,23 +277,7 @@ curl -q -g -sI https://imagegen.example.com/ # via the proxy: TLS
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/image-gen-uis.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -336,7 +338,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "49ea970f55cd616853fcf1e52aa83de8e57fb6b76cccb2b4b8664d7aecc8b0b7",
+ "body_sha256": "323781d5e470aa1f99186ca77372574fa7a5f6d63cef3a6e3b2293610775c817",
"components": {
"comfy": {
"name": "ComfyUI",
diff --git a/jupyter.md b/jupyter.md
index 6e0b056b1..d4a1e8084 100644
--- a/jupyter.md
+++ b/jupyter.md
@@ -1,5 +1,23 @@
# Jupyter: password and TLS
+Jupyter lets people write and run code in browser-based notebooks, and JupyterHub hosts notebook servers for many users. This guide helps your AI assistant configure a deployment securely, including passwords on standalone servers, TLS, origin and Host checks kept on, and separate identities and system accounts for Hub users.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/jupyter.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Jupyter Server 2.18.0, JupyterHub 5.5.2, jupyter_client 8.6.3, configurable-http-proxy 5.3.0, and NativeAuthenticator 1.3.0; 5 further sources are pinned to a commit and 6 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 63 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -548,23 +566,7 @@ Keep `open_signup` at its default `False`: with it off, a pending account waits
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/jupyter.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -662,7 +664,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "1bdfe2f4964c65f610a2748bb78167f6ccd9ceac240202250ca83181182816d5",
+ "body_sha256": "359a3aa584b686b71c6f4a858e8228a0deee908b40749114eee24808357e965e",
"components": {
"server": {
"name": "Jupyter Server",
diff --git a/kafka.md b/kafka.md
index 2442d4277..bdf41f02a 100644
--- a/kafka.md
+++ b/kafka.md
@@ -1,5 +1,23 @@
# Apache Kafka: SASL_SSL listeners, SCRAM credentials, and ACLs
+Apache Kafka is a message broker: applications write records to named topics and other applications read them. This guide helps your AI assistant make sure it is configured securely, including the plaintext listener replaced, TLS on the broker, SASL/SCRAM credentials, ACL authorization, bounded connection pressure, and authorization decisions logged.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/kafka.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Kafka listener default 4.3.1, Kafka documentation 4.3, Kafka source 4.3.0, Kafka legacy authorization 3.9, and OpenSSL documentation 3.5; 2 further sources carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 41 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -874,23 +892,7 @@ The checks below remain REASONED from the cited Kafka documentation and pinned s
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/kafka.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -957,7 +959,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "c80f1359a5fb3b112acf8d1cfebf794410c4a50e67811d9dd689202f9bf7ad24",
+ "body_sha256": "a8895638cceb0f2c665a90eea1ac7461741b44c86c0250bd384749a4f3a3e67e",
"components": {
"default": {
"name": "Kafka listener default",
diff --git a/kubernetes.md b/kubernetes.md
index d92220635..92e02e658 100644
--- a/kubernetes.md
+++ b/kubernetes.md
@@ -1,5 +1,23 @@
# Kubernetes: Gateway API TLS and authentication
+Kubernetes runs containerized applications across a cluster of machines. This guide helps your AI assistant configure cluster exposure securely, including a Gateway API entry point that terminates TLS with automatic certificates, authentication at that entry point, no casually public Services, and a protected control plane.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/kubernetes.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Kubernetes kubelet/kubeadm source v1.37.1, Envoy Gateway v1.9.1, cert-manager Gateway support minimum 1.15, and GKE new-cluster read-only-port boundary 1.32; 1 further source is pinned to a commit and 12 carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 50 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -429,23 +447,7 @@ allowed ranges out of the provider's own configuration rather than inferring the
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/kubernetes.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -531,7 +533,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "1e80b5ac6d9df2701bae1929db0d6cb2f9ce6416a58415b189d509640b8a44c8",
+ "body_sha256": "e0bf72ca6921b2109e2cccbf686f833f922dcd9408584d05d03aa9a43a5eafab",
"components": {
"kubelet": {
"name": "Kubernetes kubelet/kubeadm source",
diff --git a/litellm.md b/litellm.md
index 4a3027fd0..14618dbfd 100644
--- a/litellm.md
+++ b/litellm.md
@@ -1,5 +1,23 @@
# LiteLLM proxy: master key and virtual keys
+LiteLLM's proxy lets your apps reach many AI model providers through one address, using paid keys it holds. This guide helps your AI assistant configure it securely, including a protected master key, per-application virtual keys with spending limits, a private bind behind TLS, and request content kept out of logs.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/litellm.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against LiteLLM SSO allowance v1.76.0, LiteLLM metrics default v1.85.0, and LiteLLM CLI v1.102.1; 1 further source is pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 51 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -447,23 +465,7 @@ The checks below remain REASONED from the cited LiteLLM documentation and pinned
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/litellm.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -538,7 +540,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "2a5e3014404a2d45329664d113112b9a482ab9426c3c2c0da18d404541b2b3e6",
+ "body_sha256": "742a27a1d48e5c278e6d8f71c2ce3efc2e99f67fe027cd858e79a0b7bf0c623f",
"components": {
"sso": {
"name": "LiteLLM SSO allowance",
diff --git a/llm-observability.md b/llm-observability.md
index 8c939412f..4590d25ad 100644
--- a/llm-observability.md
+++ b/llm-observability.md
@@ -1,5 +1,23 @@
# LLM tracing and observability: Langfuse, Phoenix, Helicone, OpenTelemetry Collector
+Langfuse, Phoenix and Helicone record an AI app's prompts and responses; the OpenTelemetry Collector relays trace data. This guide helps your AI assistant configure each securely, including open signup off, authentication enabled where it ships disabled, private listeners, and TLS on Collector receivers, plus authentication on those taking off-host data.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/llm-observability.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Langfuse documentation (no recorded version), Phoenix listener source arize-phoenix-v20.16.0, OpenTelemetry Collector v0.161.0, Collector distributions v0.161.0, and curl minimum 7.75.0; 9 further sources are pinned to a commit and 4 carry no recorded version. Metadata reviewed 2026-10-17; documentation checked September 2026. The guide records 48 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -382,23 +400,7 @@ that accepts spans with no credential at all.
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/llm-observability.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -483,7 +485,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-17",
"documentation_checked": "2026-09",
- "body_sha256": "49cf8484be9817a2c60e5b7c478cdb97fdaa412fb555ac56cc03d63099b5ebe8",
+ "body_sha256": "bccda510424a75793de8f391c4d82138bbed715c67e81adacfb514c1b9c366f9",
"components": {
"langfuse": {
"name": "Langfuse documentation",
diff --git a/mcp-clients.md b/mcp-clients.md
index d041a5996..bb6a28cc9 100644
--- a/mcp-clients.md
+++ b/mcp-clients.md
@@ -1,5 +1,23 @@
# MCP clients: authorizing to Model Context Protocol servers safely
+An MCP client is the program, such as a desktop app or CLI, that talks to Model Context Protocol servers. This guide helps your AI assistant secure OAuth sign-in to remote servers, including the response issuer checked when present and required when advertised, confidential refresh tokens, and SSRF-safe discovery requests.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/mcp-clients.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against MCP 2026-07-28, OAuth 2.1 draft draft-ietf-oauth-v2-1-14, CIMD draft draft-ietf-oauth-client-id-metadata-document-00, and OpenID Connect 1.0 errata 2; 2 further sources are pinned to a commit and 2 carry no recorded version. Metadata reviewed 2026-10-17; documentation checked September 2026. The guide records 29 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -164,23 +182,7 @@ These checks are client-behaviour checks. Standing up a full malicious-authoriza
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/mcp-clients.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -236,7 +238,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-17",
"documentation_checked": "2026-09",
- "body_sha256": "7e61d3251d272d600eb84579980483338e378661f71af77fa39229aab130eb78",
+ "body_sha256": "507ddfd13be682862609aae600e35aaf5ff3875fda558e553f85ad1a5611a481",
"components": {
"mcp": {
"name": "MCP",
diff --git a/mcp-servers.md b/mcp-servers.md
index b5dc351e7..dae92c2b6 100644
--- a/mcp-servers.md
+++ b/mcp-servers.md
@@ -1,5 +1,23 @@
# MCP servers: exposing Model Context Protocol servers safely
+MCP (Model Context Protocol) lets AI apps call outside tools; an MCP server provides them, locally or over the web. This guide helps your AI assistant expose one securely, including stdio for single-user workstation tools, narrow credentials, and for HTTP servers a loopback bind, Origin checks, TLS and authentication.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/mcp-servers.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against MCP 2026-07-28, MCP legacy 2025-11-25, and curl minimum 7.75.0; 3 further sources carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 39 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -273,23 +291,7 @@ REASONED: following block; the wrong-audience probe in the following block, per
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/mcp-servers.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -353,7 +355,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "0bcd9d4fb2535bc980fd10f761968917dba5b42d4021b7142a3d1f071c184738",
+ "body_sha256": "107daa3cbc37b9666249b278fb96792e7ba3ed712bbb07018b6393d15a17f36a",
"components": {
"mcp": {
"name": "MCP",
diff --git a/memcached.md b/memcached.md
index a7d0b68c5..e69200b29 100644
--- a/memcached.md
+++ b/memcached.md
@@ -1,5 +1,23 @@
# Memcached: bind privately; authentication and TLS are optional builds
+Memcached is a cache that keeps data in memory so applications can read it quickly. This guide helps your AI assistant configure it securely, including a loopback or private bind with UDP off, an unprivileged account, and TLS and binary-protocol SASL login only on builds and clients that support them.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/memcached.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against memcached source 1.6.45 and OpenSSL CLI 3.0; 3 further sources are pinned to a commit and 4 carry no recorded version. Metadata reviewed 2026-10-15; documentation checked September 2026. The guide records 37 claims: 1 demonstrated by a check that ran and 36 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -361,23 +379,7 @@ For a binary SASL deployment, also repeat SET, GET, FLUSH, and GET through the a
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/memcached.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -442,7 +444,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-15",
"documentation_checked": "2026-09",
- "body_sha256": "77879497a23f39f20a85c1fcdb98885f433f831eaa2ed19d973079a8799d182c",
+ "body_sha256": "82b8cf0ecf7a91a0e02496521796e1f456a7443f80ac6ff38b21aa81abbf1274",
"components": {
"stable": {
"name": "memcached source",
diff --git a/minio.md b/minio.md
index b9e262132..cc7630eb5 100644
--- a/minio.md
+++ b/minio.md
@@ -1,5 +1,23 @@
# MinIO: credentials, TLS, encryption, and object protection
+MinIO (now shipped as AIStor) is object storage you run yourself: apps store files in buckets through the same API as Amazon S3. This guide helps your AI assistant configure it securely, including real root credentials, TLS, scoped application access, and encryption with a key manager.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/minio.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against AIStor documentation (no recorded version); 1 further source is pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 44 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -552,23 +570,7 @@ REASONED from the cited AIStor documentation: OIDC role-policy and claim-policy
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/minio.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -634,7 +636,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "8532b3aa69cdb790096c6fbe1ce337c046f59245c4122418832204ca3101ee94",
+ "body_sha256": "c6513da7841b2b2ceb5833dbb8b05c527d688d65babf3332b616f77ce92bedcb",
"components": {
"aistor": {
"name": "AIStor documentation",
diff --git a/model-servers.md b/model-servers.md
index 0a774f4eb..50877f8ae 100644
--- a/model-servers.md
+++ b/model-servers.md
@@ -1,5 +1,23 @@
# Model servers: llama.cpp, vLLM, TGI, SGLang, Triton, and LM Studio
+llama.cpp, vLLM, TGI, SGLang, Triton, LM Studio and text-generation-webui run AI models and answer prompts over a network API. This guide helps your AI assistant configure each securely, including a private bind, a per-client API key checked natively or by a proxy, TLS in front, and public share flags off.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/model-servers.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against llama.cpp (pinned to a commit), vLLM v0.30.0, TGI launcher/image v3.3.7, SGLang v0.5.20, and curl minimum write-out version 7.75.0; 7 further sources are pinned to a commit and 4 carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 75 claims: 3 demonstrated by a check that ran and 72 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -528,23 +546,7 @@ For cross-node endpoints in an intentionally exposed test deployment, the outsid
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/model-servers.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -654,7 +656,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "dc7078b0adb279c69f166862daf75d2ed7df8154841ffe119517de720fc237c0",
+ "body_sha256": "c5995504794d271a3afa17c309984d06bf3b3843baead15d43b4ee3d935d0ddb",
"components": {
"llama": {
"name": "llama.cpp",
diff --git a/mongodb.md b/mongodb.md
index b809745d6..47b4ec3a1 100644
--- a/mongodb.md
+++ b/mongodb.md
@@ -1,5 +1,23 @@
# MongoDB: TLS and authorization
+MongoDB is a database that stores records as flexible, JSON-like documents. This guide helps your AI assistant configure it securely, including authorization with collection-scoped application roles, a private bind, TLS for clients and cluster members, and, on MongoDB Enterprise only, auditing, diagnostic-log redaction and native storage encryption.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/mongodb.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against MongoDB bind source r8.0.32 and MongoDB documentation 8.0; 1 further source is pinned to a commit and 3 carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 81 claims: 1 demonstrated by a check that ran and 80 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -734,23 +752,7 @@ QE requires a new encrypted collection created with an `encryptedFields` definit
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/mongodb.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -856,7 +858,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "8b2445dc1e8749610ca70401436e9371ff8e3717fc36d5980a8f76e7520e47ae",
+ "body_sha256": "e82821dd0bc0e04677bf7d322ad9fa99618a81e033ff19d110a241e939490ba9",
"components": {
"bind": {
"name": "MongoDB bind source",
diff --git a/mosquitto.md b/mosquitto.md
index 93e50b1a1..a4c861e4a 100644
--- a/mosquitto.md
+++ b/mosquitto.md
@@ -1,5 +1,23 @@
# Mosquitto (MQTT): no anonymous clients, TLS listener
+Mosquitto is an MQTT broker: devices and programs publish short messages to named topics, and it passes them to whoever has subscribed. This guide helps your AI assistant make sure it is configured securely, including credentials for each device, no anonymous clients, a TLS listener, and access checked per topic.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/mosquitto.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Mosquitto v2.0.22 and v2.1.2 and Mosquitto legacy v1.6.15; 2 further sources are pinned to a commit and 2 carry no recorded version. Metadata reviewed 2026-10-05; documentation checked October 2026. The guide records 45 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -506,23 +524,7 @@ The explicit `$SYS/#` subscription should receive broker telemetry in the expose
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/mosquitto.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -593,7 +595,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-05",
"documentation_checked": "2026-10",
- "body_sha256": "73b1d3529e9fdfcd23efa56ade3bf305d2e5d39c8844da14cbcb843de2ef6dc9",
+ "body_sha256": "f4230abfb1a0cff6279347972a67fd1b425fe2baa8fb4ddb8b0f96c017d87f7b",
"components": {
"v20": {
"name": "Mosquitto",
diff --git a/mysql.md b/mysql.md
index ea83ebe23..2db09cf0b 100644
--- a/mysql.md
+++ b/mysql.md
@@ -1,5 +1,23 @@
# MySQL and MariaDB: TLS and authentication
+MySQL and MariaDB are relational databases that applications use to store their data. This guide helps your AI assistant make sure a server is configured securely: a private bind address, TLS required, scoped accounts with anonymous access removed, password validation enabled, file loading restricted, and clients connecting with verification.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/mysql.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against MySQL reference 8.4, 8.0, 9.7, and 26.7, MySQL Docker package mysql-8.4.9, and MariaDB package source mariadb-11.8.9; 2 further sources are pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 55 claims: 2 demonstrated by a check that ran and 53 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -750,23 +768,7 @@ Verification scope:
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/mysql.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -849,7 +851,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "3b7ba3deadbbecb403f8d7f1dd08cd323d71dcadc157fea97a6df766c8b1eb28",
+ "body_sha256": "eec3f21a667a9ef2e9a156f96742464a6eb8be7c86c5abe946a9b4976f0d0ba9",
"components": {
"mysql": {
"name": "MySQL reference",
diff --git a/n8n.md b/n8n.md
index f97207d51..e66259c21 100644
--- a/n8n.md
+++ b/n8n.md
@@ -1,5 +1,23 @@
# n8n: binding, TLS, and MFA
+n8n is a workflow automation tool with a web editor and webhook endpoints. This guide helps your AI assistant make sure it is configured securely: a private bind, TLS from a proxy or n8n itself, accounts with MFA, webhook authentication, and code-node execution isolated.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/n8n.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against n8n listener source n8n@2.40.6, n8n runtime source n8n@2.40.6, n8n environment policy minimum 2.18.0, n8n SSRF filter minimum 2.12.0, n8n 2.0 default exclusion source n8n@2.0.0, and n8n 1.x default exclusion source n8n@1.123.85; 2 further sources carry no recorded version. Metadata reviewed 2026-10-17; documentation checked October 2026. The guide records 29 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -130,23 +148,7 @@ curl -q -g -sS --noproxy '*' --connect-timeout 5 --max-time 10 -o /dev/null \
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/n8n.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -202,7 +204,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-17",
"documentation_checked": "2026-10",
- "body_sha256": "e6ab2c6368d6789dbe755e757ab49c02987858a1dd7f6f53731b64637310e0cc",
+ "body_sha256": "b2a8d012fa5a0129e243d83f2e6d5421340f05ecb83225898b1bb9b2e9132961",
"components": {
"server": {
"name": "n8n listener source",
diff --git a/nats.md b/nats.md
index 4f8117add..a66c1dd16 100644
--- a/nats.md
+++ b/nats.md
@@ -1,5 +1,23 @@
# NATS and JetStream: authentication, TLS, and the monitoring port
+NATS is a messaging server that passes messages between applications by subject name, and JetStream is its built-in feature for storing those messages. This guide helps your AI assistant configure a deployment securely, including required client authentication, scoped subjects, TLS, a private monitoring port, and bounded JetStream storage.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/nats.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against NATS Server v2.14.7, NATS image listener source v2.15.0, natscli v0.4.0, and Go socket source go1.26.8; 3 further sources are pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 65 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -1180,23 +1198,7 @@ REASONED: scope of the original authoring record and its shell-only evidence. Th
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/nats.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -1288,7 +1290,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "f0ed2c277c31a17bf1ab9675093049dc936f11fc2d2a8c07925c9c6fbd95d872",
+ "body_sha256": "44f2e28b39cf562f5e552741eb87c2e6c26ee81230a3540a09da3aeb481dcdaa",
"components": {
"server": {
"name": "NATS Server",
diff --git a/nginx.md b/nginx.md
index 73db0191b..da87eb2d8 100644
--- a/nginx.md
+++ b/nginx.md
@@ -1,5 +1,23 @@
# nginx: TLS and authentication
+nginx is a web server, commonly run as a reverse proxy in front of applications. This guide helps your AI assistant make sure it is configured securely: an HTTPS server block with a certificate, HTTP redirected to HTTPS, authentication required, and expensive endpoints bounded.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/nginx.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against nginx source release-1.26.3, Certbot nginx configurator v2.3.0, Authelia nginx integration v4.39.28, oauth2-proxy nginx integration v7.15.4, Apache httpd source 2.4.69, Debian apache2 packaging 2.4.69-1, HSTS specification RFC 6797, and OWASP Password Storage Cheat Sheet commit 72865b1e; 3 further sources carry no recorded version. Metadata reviewed 2026-10-17; documentation checked September 2026. The guide records 28 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -239,23 +257,7 @@ ss -tlnp # read every listener; 3000: the app itself: 127.0.0.1 only, never 0.
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/nginx.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -313,7 +315,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-17",
"documentation_checked": "2026-09",
- "body_sha256": "07eda7c75b5cada2d56a730e2c7a33df34730eec5139f55d0545aad278723811",
+ "body_sha256": "c0b31e49861f861f02aaad2b3398a3b682ae2d41f53f71f641dbc189d6d6f780",
"components": {
"nginx-source": {
"name": "nginx source",
diff --git a/nomad-consul.md b/nomad-consul.md
index dd8f15aa5..ee16f88d8 100644
--- a/nomad-consul.md
+++ b/nomad-consul.md
@@ -1,5 +1,23 @@
# Nomad and Consul: the scheduler and service-mesh APIs
+Nomad decides which machines run your jobs, and Consul is a service directory and key-value store. This guide helps your AI assistant configure the Community Edition of each securely, including private listen addresses, default-deny ACLs on every agent, Nomad TLS and gossip encryption, and only local script checks in Consul.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/nomad-consul.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Nomad Community Edition 2.0.7 and Consul Community Edition 2.0.4. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 42 claims: 13 demonstrated by a check that ran and 29 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -313,23 +331,7 @@ give the host's public address. A "connected" on a port you did not mean to expo
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/nomad-consul.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -392,7 +394,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "05ae6961d3225ec0e28ef043428dfeea38f86a7be4cfd93f6a6d58b4990f084a",
+ "body_sha256": "2bbd8a4ce0b378526374bfb530815edc031f20476a76b1bbf0cd590d0e35d9ef",
"components": {
"nomad": {
"name": "Nomad Community Edition",
diff --git a/object-storage.md b/object-storage.md
index 43bbded69..2efacddd1 100644
--- a/object-storage.md
+++ b/object-storage.md
@@ -1,5 +1,23 @@
# Object storage: S3, Cloudflare R2, Google Cloud Storage, Azure Blob, Supabase Storage
+Amazon S3, Cloudflare R2, Google Cloud Storage, Azure Blob Storage and Supabase Storage store files in buckets or, on Azure, containers. This guide helps your AI assistant configure them securely, including public access blocked for private data, per-application permissions, HTTPS enforced where supported, and short-lived signed links for sharing.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/object-storage.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Amazon S3 documentation (no recorded version); 4 further sources carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 63 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -678,23 +696,7 @@ REASONED: Historical evidence boundary; no original authoring receipts, authoriz
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/object-storage.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -781,7 +783,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "144f53a7276f2cc8a871e086cc84b0723735f429acf6d679ec60065aeaef8531",
+ "body_sha256": "7041f0cbd34c03fc6d672bcec4627cf01e04ff0a9d5c2ab383a7dd43639eb9fd",
"components": {
"s3": {
"name": "Amazon S3 documentation",
diff --git a/observability-components.md b/observability-components.md
index 36fae247d..b341d9b4e 100644
--- a/observability-components.md
+++ b/observability-components.md
@@ -1,5 +1,23 @@
# Self-hosted observability components: node_exporter, Alertmanager, Pushgateway, Jaeger, and Loki
+node_exporter, Alertmanager, Pushgateway, Jaeger and Loki are monitoring services that usually run beside Prometheus, handling host metrics, alerts, pushed metrics, traces and logs. This guide helps your AI assistant configure each securely, including private listeners, each component's TLS and authentication options switched on, and a login proxy for browsers.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/observability-components.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against node_exporter v1.12.1, Alertmanager v0.34.1, Pushgateway v1.11.3, Jaeger v2.21.0, Loki v3.7.8, Exporter toolkit v0.17.1, OpenTelemetry configtls v1.66.0, and OpenTelemetry basicauth extension v0.160.0, plus 1 more recorded basis; 3 further sources are pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 59 claims: 14 demonstrated by a check that ran and 45 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -512,23 +530,7 @@ from your own account's view of the process.
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/observability-components.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -619,7 +621,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "f45df859cb959c33bb27f11321b0c0ce89b86646e42b682ce29a8a31a314f7ae",
+ "body_sha256": "005f19103d8d98586c0210f7ab4cc5f9b4ed6e5a8ff8e08aff8e9cfe2c1688f2",
"components": {
"node": {
"name": "node_exporter",
diff --git a/ollama.md b/ollama.md
index 6b123bad3..6ef0c128f 100644
--- a/ollama.md
+++ b/ollama.md
@@ -1,5 +1,23 @@
# Ollama: it has no built-in authentication or TLS
+Ollama runs AI language models on your own machine and serves them to other apps through a local web API. This guide helps your AI assistant configure it securely, including a private listener, login, TLS and MFA at a fronting layer, model management limited to administrators, and bounded inference load.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/ollama.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Ollama v0.34.2, Docker Engine localhost boundary 28.0, and systemd v257; 1 further source is pinned to a commit and 7 carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 65 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -851,23 +869,7 @@ These commands validate configuration acceptance; they do not prove authenticati
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/ollama.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -962,7 +964,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "9ab3957a42bab62de0ca660b5a70d60cd251fdd1dd5885385764804259ab0fe8",
+ "body_sha256": "34ac518ca7b67386e0d088de717b4115b6f49aa94df5755a7d8a0d907c4e97f4",
"components": {
"ollama": {
"name": "Ollama",
diff --git a/open-webui.md b/open-webui.md
index ca48f14c9..2df4cab97 100644
--- a/open-webui.md
+++ b/open-webui.md
@@ -1,5 +1,23 @@
# Open WebUI: signup control, TLS, and MFA
+Open WebUI is a chat website you host yourself for talking to local or cloud-hosted language models. This guide helps your AI assistant configure it securely, including controlled registration, a private bind with TLS in front, authentication kept on, and restricted tools and code execution.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/open-webui.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Open WebUI (pinned to a commit) and Docker Engine localhost boundary 28.0.0; 1 further source carries no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 62 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -382,23 +400,7 @@ The native password-signin limiter is **15 attempts per 180 seconds per email ad
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/open-webui.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -482,7 +484,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "f0a5c38cca708ba4474566b366f8c9a89f4e265ed20e89cffdd87ccabe0713ab",
+ "body_sha256": "e6eb00e72d10a128963f4af6aa7f35a6edee3713ec80a492e09533e0c5395238",
"components": {
"webui": {
"name": "Open WebUI",
diff --git a/plugin/plugin.json b/plugin/plugin.json
index d5d8a26bc..1a3134037 100644
--- a/plugin/plugin.json
+++ b/plugin/plugin.json
@@ -1,7 +1,7 @@
{
"$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
"name": "secureconfig",
- "version": "1.0.704",
+ "version": "1.0.705",
"description": "Deployment-exposure guides for services AI-assisted projects commonly run: TLS, authentication, MFA, secrets, and network exposure, each line traced to a vendor page.",
"author": { "name": "Jeff Posluns", "url": "https://secureconfig.ai" },
"homepage": "https://secureconfig.ai",
diff --git a/plugin/skills/secure-deployment-config/references/MANIFEST.sha256 b/plugin/skills/secure-deployment-config/references/MANIFEST.sha256
index 84f21ca90..d926c03a4 100644
--- a/plugin/skills/secure-deployment-config/references/MANIFEST.sha256
+++ b/plugin/skills/secure-deployment-config/references/MANIFEST.sha256
@@ -8,15 +8,15 @@ b76f678010dfbb1eda11cb17174c28a07ac28cfbee453c9bf16c5e72ac2eb38b tailscale.md
6ccf37d64405e9d145a949c4d13faa411c95e4b68238cb1ed7c4d1338649b98b authentication.md
571c8cb1a6f81d2ede38db4275bff7cc763f718f8b5ee96cde2a515e9cb458d2 mfa.md
998211fa469d26e685293914ab164b3be8ef7d0826ea5353903c5704899e36b7 secrets.md
-67ead6128e8115fe289b11db4010b4fc046b44fbf797bb7d3ac6c52f4e4d4959 vault.md
+8f086822bdc20b493805d36a45de35d382d79c84926e6aef1c37f9616f4b677c vault.md
d18b415d444bcccc6ffdf29affcf52a7ed8798acd780897473f7c5db8866d8b1 identity-providers.md
34f9a78f603553459c4b3799b609107dac50751a21ea26839e6e5b54efd47b26 self-hosted-idp.md
8f464a1e55db9fbd835b0340461c39e25b773c2eedfd127fc4b3279026f1aad5 oidc-integration.md
5b2a4e906c7d70ef53535885ecea54f24c816575ad667bb9e570fd01ddf603a9 cloud-identity-proxies.md
0892e60e0a703f22a456c5e0f616a06579c0002dc8b8b9dfa06f360be8d112d8 machine-auth.md
0f8384ad79dd9210adae8372c436d70e1e93914913bc6960ac6a2f41141036a3 fronting-auth.md
-56f8e29ff170027e675d042f22199b544b0bbf779b108926d18a900e222af1b5 apache.md
-c8c900792380e7a1428660f9c3bcee688e760d59f6e1da55d9b6eb9f32619381 nginx.md
+78e92b7d890df6500fea124108ee88d865dc4176fc3dcf5a2705dfcaea358d9e apache.md
+eda6203d82ad33d26cd691dead64033eaf34bcf4c7978c4061d8a5d966b36bef nginx.md
e294462aeb6ce1498c97d8198598f79b3b8d7c0930fad5538e687587cf76887b lighttpd.md
2faf447eb185932b48165a9492f8f90ee58ab8dcf21e82fbf3f2ad1e513758af caddy.md
123465d2fd41e0e4c7017bd8d71ca4ae11fc4df11110773ffac4080bc447c7ee haproxy.md
@@ -24,9 +24,9 @@ e294462aeb6ce1498c97d8198598f79b3b8d7c0930fad5538e687587cf76887b lighttpd.md
1c5b0dbaa2cf8785f8b068eeab9862d6af304dbcc3f811d868b5a7bf38129428 nodejs.md
3fa2691c479694fc820d30c742a5b5d789fb19746ba111e96bf4d578c4be67ce python.md
8e7323e7f54d44a7354ec9c6dba22b05bbef2f5dfd545016de73c6562fae6f51 docker.md
-1b8445e0dc25fb843829d1b2fdc2c67ee64b1e63b4a89b8518f1a994e722143f kubernetes.md
-2942a7e7a6d41996126e943a4f4ac1c9e31e34c99b9b8eaa7f472b21bb65e9cf gitops-controllers.md
-4d831688e4658d37dd10f2729397f3d225fdac03d8861f20a850a8ffc9962662 self-hosted-ci-runners.md
+b93e2a36a4ba551963155e397c4e8b0ba28cf909858150f95ec44c97fab9ba7c kubernetes.md
+64fb2de2eb42f9f8833fc1a8d611c86bb12f5bf56bb93cca2fd36d383c867d33 gitops-controllers.md
+19d6d08a152d5724470cd1f2a073de7f7785d7c2bbb464f487e70f195f1a12ba self-hosted-ci-runners.md
8821c15b9a8007190be74118d90f349d2e87790908fa4bcbc2d4d6ed874dd1fa frontend-frameworks.md
3cc39b499774d04e366810d1aedd7e9c88dcf2534040d81c021d270bf37c2fb4 container-hardening.md
6d4ac36548b0de98382fc5003d0577d16be86535957f72dd33176234add90028 nextjs.md
@@ -41,64 +41,64 @@ e405670d7c1e01da133e2db155d6a9811d1d5fbeb72575428a8acdd8a467b0a1 paas.md
17091cd4ef3b1c9b8ea0be22fa019f07cf02e581b76d7b8506eba1bd959a052b egress-metadata.md
2aaa5a1425d394ebd6464a40555dd89a22a91ecd3354b9141d60cc7fa0dc8b6d gpu-clouds.md
e2fa042ae3a9fa55dc8c3521630b7bad5799522484e74b38ce16039c96d5c3dd deployment-lifecycle.md
-607338a9c1aa23484131619211818491966e30a064f2b7b2fe9a343af31918bf postgresql.md
+560f983305d6fe0a46fc7fa7be68e60bbb8cd77b43ac3a09b816f444b18497dd postgresql.md
da990e0ca7e7b950deb35fdd859677ef247db8f2aa8ca34330a857708f8830ca connection-poolers.md
-80360a609312bb18f0f7a2740de2b003d996061721f8a964a9502141506e1e27 mysql.md
-5d6b1ac0f691cb7173be5b4192e21a352ad3084077346d110d27d95dd5579b2e mongodb.md
-9317e52380265246131ac128be49b010dc43e558e3b28195b8d021991dd9eb35 redis.md
-c4b4cc58a2535e1f25ab84901d3e66fc6a8edfe66a659168d64305a4f3c3c16d elasticsearch.md
-7bd2095de648c22821f47309bf70991d14676677099e6a67232da89e25195840 minio.md
-d6bc887ba2a8c91d43314307950f8dcdef983b9671803ae0122ea1e1cd063b92 rabbitmq.md
-afc81fddf8eac06946650ec391c7c7ea32ec20e85434d923efb90c694eec526d mosquitto.md
-9b152e057242f074fa5daf2ba98e742a59fc75922926a4c16d568f142aa0ad49 kafka.md
-388b883c76b88857d2be2d790b041bc9a08239a3d077c5a8591b66060bb155e9 clickhouse.md
+9f08fd560dbd3d47fb3474202dcca149443d96130bc35cd70563a597ca17697c mysql.md
+b3d8e59b069a381481fd567b845480b417266781dee75625c5d18b7fb8f985b2 mongodb.md
+8facfc8502b9ef18c6c62515d13fafcedde8c23b287c3fab5e5b147cc467636e redis.md
+7b055225c7adb0fa4025b701e9808c1a4d856cdc26f57412b57805f284a481d9 elasticsearch.md
+4ac97d76fd65f4b879e6acb7737c7225b8e05a245fd4c295e5c3779ab4aca5cb minio.md
+77bd0351742b47af0d2559a8b984da808426f67b461c10c79b73ffd11dc9af88 rabbitmq.md
+6d1659db86904e45964854b638932ab486cc6bc616693614b2564503092f54d2 mosquitto.md
+c59735930411f45718cc591a23ce207fa5760fa1f42e0dfd77cd31629df80d2c kafka.md
+ba4c3a6e8a557f90b39ec8215c113903d8db74b2b96656ebb6ed9a2a67a6c200 clickhouse.md
f039756962ee55d6be2e5fedb1934abe359881e541ecd912805ac00d4bfaf698 neo4j.md
-e83781f3748295c4fba70c33f681d3942cf14d8717649657f7caea45af9008e0 memcached.md
-5543c2465f6cde11ce3a0d48e81fa8c82ba045d01133bbb5f98704cada4db29c object-storage.md
-8d6d98a48b2cc034ad28b70c5dabad9031c0e265d2ad9fabcc9946feb45b1af1 nats.md
-e96fc9a821530c14fd174dcb8cec56c597c6c9d9bc13e5b0b7142fbf889518f8 search-engines.md
+3d613e9cdf344eccfef8c8418f64c29e5fe0f7a039d2eb88ec1514b2d831dfc5 memcached.md
+dc8d99ca4689cac67a6ddb2c8f971cb293408f07998ca65e6ac47f44abb1431d object-storage.md
+c97d02042c461922c890bc3988c1a4774b937682d65d39cd89f7fef8a94cacaa nats.md
+3bffafb80c61b295001ce8c921d7cf8754ecaacf88be92bb914e7b3e2051fb8d search-engines.md
645f6a5783b9d0d36aa3774aba966eda27f65f6713d62a0e2256c5c8f74e27ea sqlite.md
d7ebebff08b1ceee79247dd430582ca702015395ad0fc755c30a4e5386c0b4f2 sqlite-http-frontends.md
39d509c156f6486b122cc2a5bb4da6ca6ffd7a486afd38cf83066a18e9e2df5c surrealdb.md
-5e31e69fdbe931bb373d1ba1aaf1ce65575210466dbce873b93e465111ae761e time-series-metrics-stores.md
-f8c3823a059b3641dfe2db85a8510fd2eeb0d7fa0c470e623d1700627dc74186 jupyter.md
-fc02a97d71353588b38c9b8f94f3267c468708c60dc9ba1b92d8d35a12c6b974 ollama.md
-6c50fa6dc555851541e6116e24cfdb2820a0ad49895b5504e420ea456b980c3c open-webui.md
-761195f0df800501f0b7cd334d303e608bb721c9b7942d455667404c17e1f104 litellm.md
-8f616cde466c132972f586532510143720c5913f14c65eeb841e3b28b8313bc7 model-servers.md
-27a69a97c4c10df60e2785fa6fdac38320830708111ceb38d57a4d9b6d528d3a gradio.md
-51902d22639e246400df66a67a9d07f8b7a4a22a80fb759c132713ccb9637d6a streamlit.md
-e1123a0246c615a7c78fbe545d653b790cf48a3c7c36532dc0db26d8d2a2d7c9 n8n.md
-7f134fffb87a3c563053f9f294a98a4c6fa33df28529814f1b34d3542e0c602a code-server.md
-cae5895e27a2a0d08773bf3c6f346c25deee35db50f15cfaaceff1c2545eba3e self-hosted-error-trackers.md
-486162b144bf6326acaf70fbc3cc912d0534a3927d21f95a5a4d61a3ccb97b1c vector-databases.md
-75560b7ae60244f00675674a45f3aaa1c715da1adb93f37334181d35924af9e4 mcp-servers.md
-86c0dcec778ea45f122f458981177bbe1fe089867183613939570b2fde1fdff5 mcp-clients.md
-4ea7c2c7bc490c32fac988a7eca86353dd3b9edeca51bc805c4752e958bbb5e7 ray.md
+27a995866eb7f210a147197ed78eccd1c754d1411a0d38ca7a43615238483d82 time-series-metrics-stores.md
+8512125735844d2e68eef34c758d6ae5bc7bd74d6f75213eb65e29b5ba134687 jupyter.md
+ce48798292404424a5e2e38233c7d090ea7e22bec9c0d13193b2daef5c3d8c9b ollama.md
+fa12f4a0eafcd2d89258cc8586cdd41c44c0fe39cc5a9a252b1c871a406363e0 open-webui.md
+935210c26a215b049f71914d727c6e46f5bdd5117252ebda3fafc95de768daed litellm.md
+e6893a8918c369cf184430f1f69f39e37596910f1b2d7b58a157bf174a9a0120 model-servers.md
+31cdaaa5f65c8f0ab6ba87a153214caabf53fe78122fff9995023e73b04f03dd gradio.md
+be95e652184ff7c4bf14ea8a8b40b99ab07782229d0b2e757328c771a458913c streamlit.md
+806e8de1082eb811bc9830d30b3688ec6fdc34c9189fe9eced33bb3419531e50 n8n.md
+b80bcb67b9d8c3118714ec12b9278d91383f2665e4fddec333dbcc7c19629289 code-server.md
+98dc4dcba807cdff8f409b80bf78f34272ae2cf4f039ae572056541d4ad0c949 self-hosted-error-trackers.md
+170ed7f2c5db137ad76c8c18279a4c6e080f6e873965c142829eab39c4305648 vector-databases.md
+6f828a6e357292865c8ebf04e774328b66979e64f1caf064e810c377e871fe3b mcp-servers.md
+956908acefa2151ffa1520810ee8cb2e0f8d4df14e1e40b0b30d41d980d1c9ab mcp-clients.md
+49c836e2fa0c216a7aea23a0eef0022fe5b7886e25bd90efb02646a5f5389120 ray.md
707a93ac9d3f9a15c7f716aa7d3b8c5c3067ebbd6cabe6777b232fae60aad4db mlflow.md
-02779a52c70f2d558f5053862d4f68f69a2ffbe143a756e55b4d26f865dcd2a3 agent-builders.md
-f205ad0512c2ad45bee20f9cce6faee7eaadddc16af066c413eee316ec79efa9 ai-infra-services.md
-5448efdd90dc5fdf90429e23ef8b8dbad8cad33a36b2d056ca426a63b4d56096 realtime-voice-infra.md
-6b2981ef25b7920fae2233cb7fa2e8583b79d92af2aff8a715a585a0831dec60 image-gen-uis.md
-eedd2df7ea2844e3500579dddd9a18e57c746b7f49616bc76d9cdad0d20e235e chat-uis.md
-de45069e092247a3e60962e15ae9e775cfcc6520a983aaf91699332f94816311 llm-observability.md
-bf00fe82a4905fa71a3a8aaf534ab7e60f5ee342259d6c7b910468057d1a9d60 workflow-orchestrators.md
+5c000619a749aa7b234fbd635a0fc5f9cf775053855b1aff14a225e19970353b agent-builders.md
+6f92af64e4ad83fea5bc41574ca3572551ce2e00ae6e0fbc5fec64e592e0b914 ai-infra-services.md
+693dd8b36a53cb51bd3258b85ac7ae528e3a4750dede765a6b3cbfe9202ed0a6 realtime-voice-infra.md
+ad6e4e94f17ccccfbe2aca036580053a4417b33b30b2ea9f63feeb9dac796609 image-gen-uis.md
+ade59d822ddbe6983a4241d9ed5f73c37830de52154bb98e192ddc8874c62505 chat-uis.md
+c8e8feb53e60e497c69f85898fda8f4d83027f6f115007727c0ad1ca3a479b0c llm-observability.md
+c878d5339e55a9e4188ba1dce748c37c72291d697641b02615fce73e54c4f493 workflow-orchestrators.md
f09c2c0f0f00dc39f8cb42b3067220b8baddd997a4226f3b66ca26eb735d071f admin-uis.md
-bd72febbec4b4aba89c866898fb3bc6f821985de356f733fdea356637f512cd8 observability-components.md
+5b5ec2cf8d694aafdd0f3b92d6ff6ab594c0d76d2c0a559e3addfc02f0132453 observability-components.md
59a50514647c171508ee697dafa4114f68e13d5d75053a76c3ec6b6ef09635bb devops-uis.md
96807f276db704f93b2cf9f6a74462372e306bc727041a405e64a78e57e85dc8 cors.md
b342da74961426bb8757064ffadaace7a802f7ea9c90d357840821f2c724918f headers.md
-7f6a4be63fe75218a7290360d7fa05e4f3eed04e759fd2279b8f9090ef8969d4 firebase-supabase.md
-14a0db1c936d383f538b6c4be91a626020969dbd6bc5c59bafec40cdc6a8aa34 supabase-self-hosted.md
+e09b44bfe3beaafba9a394184f89158dc6aa6495431184b3be6d258e027a25dc firebase-supabase.md
+fcf7d6db164523f4e92fc74cd80e71350348233bae3b33a6160410ec17b438bf supabase-self-hosted.md
1b08c02dc15252340becfa270cefde0f8381b4cff68565b69b9c94dd72ed33c4 web-exposure.md
-d47b8df006d058984f8d30c5fd9345fddb9dd5449d14da83047d0d1338d2be7c realtime-webhooks.md
+e36bfb3ec5bd622f7c37399f8a89b856eaaf31c6262d4a8a31fd1d7a3a121a02 realtime-webhooks.md
72d9c43f73e6b0fc6d0b49b0b305cad98c7aa7019bfc9c50d993373269b0de12 transactional-email-posture.md
d474e2e64d33e33d8556bf64fc1199df39c1f902e4514dbd9e8c46099ac9092d bi-dashboards.md
1b9435b5fbfcd08885235e9f590946cf941922df7a07b081b8afda62be1b701b low-code-builders.md
f2c74dba7a154cfdac2d0af924ab3cdb6fbe5753674c8e97449fdaa4534d3f6b server-admin-panels.md
-57e33f986cc7430a583d4fa395fc97b46cc799414b95114a6fc66e7e46c02d26 nomad-consul.md
-e2ed2544c21ba3583b6940b45e5503dbf7c22d0a2f4dab1b77244fdf203e2d6b pocketbase.md
-31edb9401ef4e8f4374e2036f894e47c69d3888ffebb5bc921db05ae37136c52 headless-browser-services.md
-884133e5681475d42f1a4ae96e0f4052bcad9dbca756091199e39c4e08356e6b headless-cms-instant-api.md
+6cafd64a6b763c7e7343e23e1950939cde41483fe42e88513ce98985498770e7 nomad-consul.md
+6eba96aa22b23fc1c322656cfc30e24709d4bab86e5da5d2586fbeff0e191a79 pocketbase.md
+bde56f0d667e4e049c1148694644e0d53d08814f5b235b3c777cbd94934aafce headless-browser-services.md
+500584a141c5f83db4b1ff7037d13c370e8b5e667952a139a85c33c53d927ae1 headless-cms-instant-api.md
6edecfd9dd24bdaab2a9fa54f95201f451d9d3c2379454d818e0cae071a2aed7 exposure-index.md
b4a22108842595f276f0bbbcd8b43a3677e71ad3a3cbd1d5116fd0789cbdd7ad common-mistakes.md
diff --git a/plugin/skills/secure-deployment-config/references/agent-builders.md b/plugin/skills/secure-deployment-config/references/agent-builders.md
index 05743d552..4b9d11336 100644
--- a/plugin/skills/secure-deployment-config/references/agent-builders.md
+++ b/plugin/skills/secure-deployment-config/references/agent-builders.md
@@ -1,5 +1,23 @@
# Agent and workflow builders: Dify, Flowise, Langflow, LibreChat
+Dify, Flowise, Langflow and LibreChat are tools for building AI chatbots, agents and workflows whose flows can run code and call other services. This guide helps your AI assistant configure each securely, including private binds behind TLS, default secrets replaced, MFA from OIDC or a fronting proxy, and contained flows.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/agent-builders.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Dify plugin daemon 0.6.10, Flowise account minimum v3.0.1, Langflow settings source v1.12.6, LibreChat changelog v0.7.7, Docker Compose go.mod v2.24.3, Docker Compose release source v2.24.4, compose-go loader v2.0.0-rc.2, and compose-go reset loader v2.0.0-rc.3; 8 further sources are pinned to a commit and 5 carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 58 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -284,23 +302,7 @@ curl -q -g -sS -L --proto-redir '=https' --noproxy '*' --connect-timeout 5 --max
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/agent-builders.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -398,7 +400,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-19",
"documentation_checked": "2026-09",
- "body_sha256": "d9b3ee77e381107c6cb13fbb56ef6cc80dad8ebcffdf662fb0c82608db2cd8f2",
+ "body_sha256": "0d9ea78e5c061542cfce533e70348b663d5fd6fd199aab9cbbff6a99b0b5cefa",
"components": {
"daemon": {
"name": "Dify plugin daemon",
diff --git a/plugin/skills/secure-deployment-config/references/ai-infra-services.md b/plugin/skills/secure-deployment-config/references/ai-infra-services.md
index df55365ce..dd0674818 100644
--- a/plugin/skills/secure-deployment-config/references/ai-infra-services.md
+++ b/plugin/skills/secure-deployment-config/references/ai-infra-services.md
@@ -1,5 +1,23 @@
# AI infrastructure services: SearxNG, LocalAI, Text Embeddings Inference, LangServe, Mem0, and Onyx
+SearxNG, LocalAI, Text Embeddings Inference, LangServe, Mem0 and Onyx are building blocks for AI apps, from web search to agent memory. This guide helps your AI assistant configure each securely, including authenticated TLS ingress, built-in login or keys enabled where available, and unpublished backing services, apart from deliberate loopback access.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/ai-infra-services.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against SearxNG documentation (no recorded version), TEI HTTP source v1.9.0, Onyx v4.3 source v4.3.13, Onyx v4.4 source v4.4.0, and GNU grep 3.12; 6 further sources are pinned to a commit and 6 carry no recorded version. Metadata reviewed 2026-10-15; documentation checked September 2026. The guide records 47 claims: 1 demonstrated by a check that ran and 46 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -494,23 +512,7 @@ The service facts come from the maintainer's vendor-source verification record d
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/ai-infra-services.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -593,7 +595,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-15",
"documentation_checked": "2026-09",
- "body_sha256": "b9931192e8250b1cb318e09284506c74670be8caecc620df4a16d60b15d8d9a0",
+ "body_sha256": "60945815f4a2fd5042b73043af96642c80d50eb23fc37dd84c49f1bf0656d6fe",
"components": {
"searx": {
"name": "SearxNG documentation",
diff --git a/plugin/skills/secure-deployment-config/references/apache.md b/plugin/skills/secure-deployment-config/references/apache.md
index 6659c4fdd..29424a8f6 100644
--- a/plugin/skills/secure-deployment-config/references/apache.md
+++ b/plugin/skills/secure-deployment-config/references/apache.md
@@ -1,5 +1,23 @@
# Apache HTTP Server: TLS and authentication
+Apache HTTP Server is a web server for serving sites over HTTP and HTTPS. This guide helps your AI assistant make sure it is configured securely: the TLS modules enabled, an HTTPS virtual host configured, HTTP redirected to HTTPS, and authentication required where needed.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/apache.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Apache HTTP Server 2.4, Apache TLSv1.3 minimum 2.4.36+, Apache per-vhost protocol minimum 2.4.42+, Apache chain-file minimum 2.4.8, httpd htpasswd 2.4.69, OpenSSL qualification 1.1.1+, Certbot Apache installation v2.3.0, and Debian apache2 packaging 2.4.69-1, plus 5 more recorded bases; 1 further source carries no recorded version. Metadata reviewed 2026-10-18; documentation checked September 2026. The guide records 20 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -165,23 +183,7 @@ sudo apachectl -S # the vhost list, in Apache's own matchi
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/apache.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -234,7 +236,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-18",
"documentation_checked": "2026-09",
- "body_sha256": "645f3f5ab27a4df2af69e0680ac8e98f85ca416fe85a078c95075598e9b33f4d",
+ "body_sha256": "1337f946ff115e07d47b82d92b16b180220ad1d5cada50672a7a286bf5e4bbd3",
"components": {
"apache": {
"name": "Apache HTTP Server",
diff --git a/plugin/skills/secure-deployment-config/references/chat-uis.md b/plugin/skills/secure-deployment-config/references/chat-uis.md
index ce3ba248b..faf6d8249 100644
--- a/plugin/skills/secure-deployment-config/references/chat-uis.md
+++ b/plugin/skills/secure-deployment-config/references/chat-uis.md
@@ -1,5 +1,23 @@
# Self-hosted chat and agent UIs: AnythingLLM, LobeChat, Chainlit, OpenHands
+AnythingLLM, LobeChat, Chainlit and OpenHands are self-hosted web apps for AI chat and agents. This guide helps your AI assistant configure them securely, including loopback-only ports, LobeChat's registration allowlist, a Chainlit auth callback, and OpenHands reached only through an authenticated tunnel.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/chat-uis.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against AnythingLLM documentation (no recorded version), LobeHub v2.2.16, Docker CLI v27.5.1, Docker Compose v2.32.4, compose-go v2.4.7, Moby v27.5.1, and curl minimum write-out version 7.75.0; 6 further sources carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 30 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -227,23 +245,7 @@ REASONED: preceding block; isolation comparison, listener and external-reachabil
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/chat-uis.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -305,7 +307,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "a8ab396d9c1bb40454583d61e0e4744beaaa5f79069feb09514fede626474e5f",
+ "body_sha256": "a9847336a2a39bf79a5469467afc003a27b16269bf58717e83381db9075457ed",
"components": {
"anything": {
"name": "AnythingLLM documentation",
diff --git a/plugin/skills/secure-deployment-config/references/clickhouse.md b/plugin/skills/secure-deployment-config/references/clickhouse.md
index 54b1e0fc8..68b6fe33e 100644
--- a/plugin/skills/secure-deployment-config/references/clickhouse.md
+++ b/plugin/skills/secure-deployment-config/references/clickhouse.md
@@ -1,5 +1,23 @@
# ClickHouse: listen address, the default user, and TLS ports
+ClickHouse is a database server built for analytical queries over very large tables. This guide helps your AI assistant configure it securely, including a narrow listen address, a password on the default user with real accounts beside it, query limits and quotas, and TLS ports with plaintext ports off.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/clickhouse.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against ClickHouse documentation (no recorded version); 5 further sources are pinned to a commit and 2 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 53 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -687,23 +705,7 @@ SHOW CREATE TABLE system.session_log;
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/clickhouse.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -783,7 +785,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "67374bff4359a86dc344995e032dda6915d16c577426b9a057ca0bf54b0de417",
+ "body_sha256": "14afbfa6b0f58e11e9255aff2b25d80a98cf91b747e75e1d0f4f8bb56ea50474",
"components": {
"docs": {
"name": "ClickHouse documentation",
diff --git a/plugin/skills/secure-deployment-config/references/code-server.md b/plugin/skills/secure-deployment-config/references/code-server.md
index 5ae14b9e0..073f4f092 100644
--- a/plugin/skills/secure-deployment-config/references/code-server.md
+++ b/plugin/skills/secure-deployment-config/references/code-server.md
@@ -1,5 +1,23 @@
# code-server: browser VS Code without giving away the machine
+code-server runs VS Code on a server for use in a browser, and its terminal runs commands on that server. This guide helps your AI assistant configure it securely, including SSH forwarding first, a tailnet or MFA-protected tunnel next, and otherwise a loopback bind behind a TLS proxy adding MFA.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/code-server.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against code-server v4.137.0. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 18 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -118,23 +136,7 @@ REASONED: preceding block; listener inventory, direct-origin isolation, paired e
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/code-server.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -172,7 +174,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "4dfd35a63a16c1e36dc1b89dd972dd12f78009c6ba4876f4a2ef920a7f18bfbe",
+ "body_sha256": "6af52661ed92dd7e53af1386f2ab7b4fc21d17234fed1678687fac88fbef6a48",
"components": {
"server": {
"name": "code-server",
diff --git a/plugin/skills/secure-deployment-config/references/elasticsearch.md b/plugin/skills/secure-deployment-config/references/elasticsearch.md
index 8dc60ed2b..5f8e9f237 100644
--- a/plugin/skills/secure-deployment-config/references/elasticsearch.md
+++ b/plugin/skills/secure-deployment-config/references/elasticsearch.md
@@ -1,5 +1,23 @@
# Elasticsearch and OpenSearch: keep security switched on
+Elasticsearch and OpenSearch are search engines that index documents and logs for searching. This guide helps your AI assistant keep their security switched on, including TLS and authentication, scoped roles, anonymous access off, CORS off unless a browser needs it, and audit logging on OpenSearch or paid Elasticsearch tiers.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/elasticsearch.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Elasticsearch API 8.x, Elasticsearch reference 8.19, Elasticsearch listener source 8.19.22 and 9.5.4, OpenSearch reference 3.6, OpenSearch S3 reference 3.1, OpenSearch S3 source 3.8.0, OpenSearch GCS source 3.8.0, and OpenSearch Azure source 3.8.0, plus 5 more recorded bases; 3 further sources are pinned to a commit and 4 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 65 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -1012,23 +1030,7 @@ REASONED: deployment expectations and source-audit limits recorded in this guide
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/elasticsearch.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -1134,7 +1136,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "b7be20e1e922213f3221d68ed2688b87163c51f827766052d8f533076a1938ab",
+ "body_sha256": "28bc44a107ca57a92533925c4be8dce48e1af9a9ab4a126737a9a91b7fbcd15d",
"components": {
"es-api": {
"name": "Elasticsearch API",
diff --git a/plugin/skills/secure-deployment-config/references/firebase-supabase.md b/plugin/skills/secure-deployment-config/references/firebase-supabase.md
index 46d251875..b3e4a84e1 100644
--- a/plugin/skills/secure-deployment-config/references/firebase-supabase.md
+++ b/plugin/skills/secure-deployment-config/references/firebase-supabase.md
@@ -1,5 +1,23 @@
# Firebase and Supabase: the rules are the security
+Firebase and Supabase are hosted app backends whose database, storage, sign-in and functions are called directly from client code. This guide helps your AI assistant configure each securely, including Firebase Security Rules or Supabase row-level security with grants, separately authorized functions and storage, and server keys kept off clients.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/firebase-supabase.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Firebase documentation (no recorded version), PostgreSQL invoker-view minimum 15, curl curl-8_14_1, and ShellCheck v0.11.0; 2 further sources carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 70 claims: 2 demonstrated by a check that ran and 68 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -957,23 +975,7 @@ REASONED: tool-version provenance for the historical local runs above; the [Shel
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/firebase-supabase.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -1068,7 +1070,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-19",
"documentation_checked": "2026-09",
- "body_sha256": "6690687db9e1d66f3e67a898fc0b030022e55be24166bc29b8c35554e8081891",
+ "body_sha256": "bbf1862c56fcb74db81c1981d8fea7f6d06de5733b616f2c54b21cea041ce073",
"components": {
"firebase": {
"name": "Firebase documentation",
diff --git a/plugin/skills/secure-deployment-config/references/gitops-controllers.md b/plugin/skills/secure-deployment-config/references/gitops-controllers.md
index e1aee0078..2bdb26fc1 100644
--- a/plugin/skills/secure-deployment-config/references/gitops-controllers.md
+++ b/plugin/skills/secure-deployment-config/references/gitops-controllers.md
@@ -1,5 +1,23 @@
# GitOps controllers: Argo CD and Flux
+Argo CD and Flux are GitOps tools: they watch a Git repository and keep a Kubernetes cluster matching it, using whatever permissions they are granted. This guide helps your AI assistant configure each securely, including guarded admin access, reviewed changes to the repositories they deploy, narrow credentials, and restricted egress.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/gitops-controllers.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Argo CD v3.5.3 source (pinned to a commit), Flux OIDC introduction v2.9, Dex source v2.45.1, Redis source 8.2.3, and curl curl-8_14_1; 1 further source is pinned to a commit and 3 carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 50 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -468,23 +486,7 @@ they were not rechecked online. Remaining source limits are identified above.
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/gitops-controllers.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -562,7 +564,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-19",
"documentation_checked": "2026-09",
- "body_sha256": "908b108054ff323b7d30f6ec6652728a0d065571804b124943b579b8f09f77cc",
+ "body_sha256": "290b24b86bba2e9137a85bd45010968f38ebe895865712fb799a2f15553b9f5a",
"components": {
"argo": {
"name": "Argo CD v3.5.3 source",
diff --git a/plugin/skills/secure-deployment-config/references/gradio.md b/plugin/skills/secure-deployment-config/references/gradio.md
index d9f5708bd..ca3562dfe 100644
--- a/plugin/skills/secure-deployment-config/references/gradio.md
+++ b/plugin/skills/secure-deployment-config/references/gradio.md
@@ -1,5 +1,23 @@
# Gradio: launch() authentication and TLS
+Gradio is a Python framework that serves an interactive web app from a script's launch() call. This guide helps your AI assistant make sure an app is configured securely: a login required, TLS in place, public sharing avoided, file access and uploads restricted, and queued work and URL fetching bounded.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/gradio.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Gradio 6.28.0 and Gradio historical fixes 6.16.0 and 6.20.0; 2 further sources carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 53 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -328,23 +346,7 @@ ss -tlnp # With server_port=None, the port search starts at 7860 unless GRADIO
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/gradio.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -421,7 +423,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "b05b85a4144bcb16a146ea0834470b7f5b89ae7edc2bd28e0de73d88d5cc0eb4",
+ "body_sha256": "c44959d1827e9747ad6155b6d85ce94ee5a79954570c23c478db0531c82a0ec1",
"components": {
"gradio": {
"name": "Gradio",
diff --git a/plugin/skills/secure-deployment-config/references/headless-browser-services.md b/plugin/skills/secure-deployment-config/references/headless-browser-services.md
index 450df11da..9cc9c125d 100644
--- a/plugin/skills/secure-deployment-config/references/headless-browser-services.md
+++ b/plugin/skills/secure-deployment-config/references/headless-browser-services.md
@@ -1,5 +1,23 @@
# Headless browser services: Chrome DevTools Protocol, Selenium Grid, browserless, and Playwright server
+Chrome DevTools Protocol, Selenium Grid, browserless and Playwright server let programs control a real browser for testing, scraping or AI agents. This guide helps your AI assistant configure each securely, including automation ports on loopback or a restricted private network, authenticated remote access, limited browser egress, and protected connection URLs.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/headless-browser-services.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Chromium 154.0.8037.57, browserless (open source) 2.56.7, browserless Playwright file-protocol fix 2.51.0, Playwright source v1.58.2, and curl documentation curl-8_14_1; 2 further sources are pinned to a commit and 6 carry no recorded version. Metadata reviewed 2026-10-05; documentation checked October 2026. The guide records 32 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -290,23 +308,7 @@ missing files, authentication failures, connection failures, and timeouts are in
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/headless-browser-services.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -370,7 +372,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-05",
"documentation_checked": "2026-10",
- "body_sha256": "83eb3c90295cb9d91e397cfa9e10e498bcf3591cc59ea0b23a98e47d7021298b",
+ "body_sha256": "ebb4a62836b2de94321149bbe30a946e00bd1e41c808d1c02be928657667b931",
"components": {
"chromium": {
"name": "Chromium",
diff --git a/plugin/skills/secure-deployment-config/references/headless-cms-instant-api.md b/plugin/skills/secure-deployment-config/references/headless-cms-instant-api.md
index af646c72f..4d32ee269 100644
--- a/plugin/skills/secure-deployment-config/references/headless-cms-instant-api.md
+++ b/plugin/skills/secure-deployment-config/references/headless-cms-instant-api.md
@@ -1,5 +1,23 @@
# Instant API backends: Strapi, Directus, Hasura, and PostgREST
+Strapi, Directus, Hasura and PostgREST are backend tools that give apps a generated API over your database. This guide helps your AI assistant configure each securely, including Strapi and Directus admins created privately, Hasura's admin secret set, PostgREST's role grants kept narrow, and secrets kept out of committed files.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/headless-cms-instant-api.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Strapi Users and Permissions source v5.58.0, Directus listener source v12.4.1, Directus quickstart 12.0.2, Hasura quickstart image 2.46.0, Hasura authentication-status minimum 2.48.0, and PostgREST listener source v16.4; 6 further sources carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 48 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -378,23 +396,7 @@ Version boundary at the time of writing: Strapi 5 documentation; current Directu
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/headless-cms-instant-api.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -473,7 +475,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "52cb6bf055f819d9f1a2989a161eea24062bedbbc7b18ba52bab952e739e5d1e",
+ "body_sha256": "1da7b80791f7217c4a2edcee5bab9cf8879fdb6f2675692a32bd1bb94fbc6474",
"components": {
"strapi-signup-source": {
"name": "Strapi Users and Permissions source",
diff --git a/plugin/skills/secure-deployment-config/references/image-gen-uis.md b/plugin/skills/secure-deployment-config/references/image-gen-uis.md
index 9d95f711a..5f76e03cd 100644
--- a/plugin/skills/secure-deployment-config/references/image-gen-uis.md
+++ b/plugin/skills/secure-deployment-config/references/image-gen-uis.md
@@ -1,5 +1,23 @@
# Image-generation UIs: ComfyUI, Stable Diffusion WebUI, InvokeAI, Fooocus
+ComfyUI, Stable Diffusion WebUI, InvokeAI and Fooocus are self-hosted browser apps for creating images with AI models. This guide helps your AI assistant configure each securely, including ports reachable only on host loopback, a tunnel or authenticated TLS proxy in front, Gradio share links off, and hardened containers where used.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/image-gen-uis.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against ComfyUI v0.37.0, AUTOMATIC1111 v1.10.1, Fooocus v2.5.5, Gradio 3.41.2, Docker Engine minimum loopback boundary 28.0, Docker Compose source v2.32.4, and curl minimum write-out version 7.75.0; 1 further source is pinned to a commit and 6 carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 28 claims: 2 demonstrated by a check that ran and 26 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -259,23 +277,7 @@ curl -q -g -sI https://imagegen.example.com/ # via the proxy: TLS
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/image-gen-uis.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -336,7 +338,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "49ea970f55cd616853fcf1e52aa83de8e57fb6b76cccb2b4b8664d7aecc8b0b7",
+ "body_sha256": "323781d5e470aa1f99186ca77372574fa7a5f6d63cef3a6e3b2293610775c817",
"components": {
"comfy": {
"name": "ComfyUI",
diff --git a/plugin/skills/secure-deployment-config/references/jupyter.md b/plugin/skills/secure-deployment-config/references/jupyter.md
index 6e0b056b1..d4a1e8084 100644
--- a/plugin/skills/secure-deployment-config/references/jupyter.md
+++ b/plugin/skills/secure-deployment-config/references/jupyter.md
@@ -1,5 +1,23 @@
# Jupyter: password and TLS
+Jupyter lets people write and run code in browser-based notebooks, and JupyterHub hosts notebook servers for many users. This guide helps your AI assistant configure a deployment securely, including passwords on standalone servers, TLS, origin and Host checks kept on, and separate identities and system accounts for Hub users.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/jupyter.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Jupyter Server 2.18.0, JupyterHub 5.5.2, jupyter_client 8.6.3, configurable-http-proxy 5.3.0, and NativeAuthenticator 1.3.0; 5 further sources are pinned to a commit and 6 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 63 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -548,23 +566,7 @@ Keep `open_signup` at its default `False`: with it off, a pending account waits
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/jupyter.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -662,7 +664,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "1bdfe2f4964c65f610a2748bb78167f6ccd9ceac240202250ca83181182816d5",
+ "body_sha256": "359a3aa584b686b71c6f4a858e8228a0deee908b40749114eee24808357e965e",
"components": {
"server": {
"name": "Jupyter Server",
diff --git a/plugin/skills/secure-deployment-config/references/kafka.md b/plugin/skills/secure-deployment-config/references/kafka.md
index 2442d4277..bdf41f02a 100644
--- a/plugin/skills/secure-deployment-config/references/kafka.md
+++ b/plugin/skills/secure-deployment-config/references/kafka.md
@@ -1,5 +1,23 @@
# Apache Kafka: SASL_SSL listeners, SCRAM credentials, and ACLs
+Apache Kafka is a message broker: applications write records to named topics and other applications read them. This guide helps your AI assistant make sure it is configured securely, including the plaintext listener replaced, TLS on the broker, SASL/SCRAM credentials, ACL authorization, bounded connection pressure, and authorization decisions logged.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/kafka.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Kafka listener default 4.3.1, Kafka documentation 4.3, Kafka source 4.3.0, Kafka legacy authorization 3.9, and OpenSSL documentation 3.5; 2 further sources carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 41 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -874,23 +892,7 @@ The checks below remain REASONED from the cited Kafka documentation and pinned s
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/kafka.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -957,7 +959,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "c80f1359a5fb3b112acf8d1cfebf794410c4a50e67811d9dd689202f9bf7ad24",
+ "body_sha256": "a8895638cceb0f2c665a90eea1ac7461741b44c86c0250bd384749a4f3a3e67e",
"components": {
"default": {
"name": "Kafka listener default",
diff --git a/plugin/skills/secure-deployment-config/references/kubernetes.md b/plugin/skills/secure-deployment-config/references/kubernetes.md
index d92220635..92e02e658 100644
--- a/plugin/skills/secure-deployment-config/references/kubernetes.md
+++ b/plugin/skills/secure-deployment-config/references/kubernetes.md
@@ -1,5 +1,23 @@
# Kubernetes: Gateway API TLS and authentication
+Kubernetes runs containerized applications across a cluster of machines. This guide helps your AI assistant configure cluster exposure securely, including a Gateway API entry point that terminates TLS with automatic certificates, authentication at that entry point, no casually public Services, and a protected control plane.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/kubernetes.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Kubernetes kubelet/kubeadm source v1.37.1, Envoy Gateway v1.9.1, cert-manager Gateway support minimum 1.15, and GKE new-cluster read-only-port boundary 1.32; 1 further source is pinned to a commit and 12 carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 50 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -429,23 +447,7 @@ allowed ranges out of the provider's own configuration rather than inferring the
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/kubernetes.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -531,7 +533,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "1e80b5ac6d9df2701bae1929db0d6cb2f9ce6416a58415b189d509640b8a44c8",
+ "body_sha256": "e0bf72ca6921b2109e2cccbf686f833f922dcd9408584d05d03aa9a43a5eafab",
"components": {
"kubelet": {
"name": "Kubernetes kubelet/kubeadm source",
diff --git a/plugin/skills/secure-deployment-config/references/litellm.md b/plugin/skills/secure-deployment-config/references/litellm.md
index 4a3027fd0..14618dbfd 100644
--- a/plugin/skills/secure-deployment-config/references/litellm.md
+++ b/plugin/skills/secure-deployment-config/references/litellm.md
@@ -1,5 +1,23 @@
# LiteLLM proxy: master key and virtual keys
+LiteLLM's proxy lets your apps reach many AI model providers through one address, using paid keys it holds. This guide helps your AI assistant configure it securely, including a protected master key, per-application virtual keys with spending limits, a private bind behind TLS, and request content kept out of logs.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/litellm.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against LiteLLM SSO allowance v1.76.0, LiteLLM metrics default v1.85.0, and LiteLLM CLI v1.102.1; 1 further source is pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 51 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -447,23 +465,7 @@ The checks below remain REASONED from the cited LiteLLM documentation and pinned
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/litellm.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -538,7 +540,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "2a5e3014404a2d45329664d113112b9a482ab9426c3c2c0da18d404541b2b3e6",
+ "body_sha256": "742a27a1d48e5c278e6d8f71c2ce3efc2e99f67fe027cd858e79a0b7bf0c623f",
"components": {
"sso": {
"name": "LiteLLM SSO allowance",
diff --git a/plugin/skills/secure-deployment-config/references/llm-observability.md b/plugin/skills/secure-deployment-config/references/llm-observability.md
index 8c939412f..4590d25ad 100644
--- a/plugin/skills/secure-deployment-config/references/llm-observability.md
+++ b/plugin/skills/secure-deployment-config/references/llm-observability.md
@@ -1,5 +1,23 @@
# LLM tracing and observability: Langfuse, Phoenix, Helicone, OpenTelemetry Collector
+Langfuse, Phoenix and Helicone record an AI app's prompts and responses; the OpenTelemetry Collector relays trace data. This guide helps your AI assistant configure each securely, including open signup off, authentication enabled where it ships disabled, private listeners, and TLS on Collector receivers, plus authentication on those taking off-host data.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/llm-observability.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Langfuse documentation (no recorded version), Phoenix listener source arize-phoenix-v20.16.0, OpenTelemetry Collector v0.161.0, Collector distributions v0.161.0, and curl minimum 7.75.0; 9 further sources are pinned to a commit and 4 carry no recorded version. Metadata reviewed 2026-10-17; documentation checked September 2026. The guide records 48 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -382,23 +400,7 @@ that accepts spans with no credential at all.
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/llm-observability.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -483,7 +485,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-17",
"documentation_checked": "2026-09",
- "body_sha256": "49cf8484be9817a2c60e5b7c478cdb97fdaa412fb555ac56cc03d63099b5ebe8",
+ "body_sha256": "bccda510424a75793de8f391c4d82138bbed715c67e81adacfb514c1b9c366f9",
"components": {
"langfuse": {
"name": "Langfuse documentation",
diff --git a/plugin/skills/secure-deployment-config/references/mcp-clients.md b/plugin/skills/secure-deployment-config/references/mcp-clients.md
index d041a5996..bb6a28cc9 100644
--- a/plugin/skills/secure-deployment-config/references/mcp-clients.md
+++ b/plugin/skills/secure-deployment-config/references/mcp-clients.md
@@ -1,5 +1,23 @@
# MCP clients: authorizing to Model Context Protocol servers safely
+An MCP client is the program, such as a desktop app or CLI, that talks to Model Context Protocol servers. This guide helps your AI assistant secure OAuth sign-in to remote servers, including the response issuer checked when present and required when advertised, confidential refresh tokens, and SSRF-safe discovery requests.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/mcp-clients.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against MCP 2026-07-28, OAuth 2.1 draft draft-ietf-oauth-v2-1-14, CIMD draft draft-ietf-oauth-client-id-metadata-document-00, and OpenID Connect 1.0 errata 2; 2 further sources are pinned to a commit and 2 carry no recorded version. Metadata reviewed 2026-10-17; documentation checked September 2026. The guide records 29 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -164,23 +182,7 @@ These checks are client-behaviour checks. Standing up a full malicious-authoriza
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/mcp-clients.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -236,7 +238,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-17",
"documentation_checked": "2026-09",
- "body_sha256": "7e61d3251d272d600eb84579980483338e378661f71af77fa39229aab130eb78",
+ "body_sha256": "507ddfd13be682862609aae600e35aaf5ff3875fda558e553f85ad1a5611a481",
"components": {
"mcp": {
"name": "MCP",
diff --git a/plugin/skills/secure-deployment-config/references/mcp-servers.md b/plugin/skills/secure-deployment-config/references/mcp-servers.md
index b5dc351e7..dae92c2b6 100644
--- a/plugin/skills/secure-deployment-config/references/mcp-servers.md
+++ b/plugin/skills/secure-deployment-config/references/mcp-servers.md
@@ -1,5 +1,23 @@
# MCP servers: exposing Model Context Protocol servers safely
+MCP (Model Context Protocol) lets AI apps call outside tools; an MCP server provides them, locally or over the web. This guide helps your AI assistant expose one securely, including stdio for single-user workstation tools, narrow credentials, and for HTTP servers a loopback bind, Origin checks, TLS and authentication.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/mcp-servers.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against MCP 2026-07-28, MCP legacy 2025-11-25, and curl minimum 7.75.0; 3 further sources carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 39 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -273,23 +291,7 @@ REASONED: following block; the wrong-audience probe in the following block, per
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/mcp-servers.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -353,7 +355,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "0bcd9d4fb2535bc980fd10f761968917dba5b42d4021b7142a3d1f071c184738",
+ "body_sha256": "107daa3cbc37b9666249b278fb96792e7ba3ed712bbb07018b6393d15a17f36a",
"components": {
"mcp": {
"name": "MCP",
diff --git a/plugin/skills/secure-deployment-config/references/memcached.md b/plugin/skills/secure-deployment-config/references/memcached.md
index a7d0b68c5..e69200b29 100644
--- a/plugin/skills/secure-deployment-config/references/memcached.md
+++ b/plugin/skills/secure-deployment-config/references/memcached.md
@@ -1,5 +1,23 @@
# Memcached: bind privately; authentication and TLS are optional builds
+Memcached is a cache that keeps data in memory so applications can read it quickly. This guide helps your AI assistant configure it securely, including a loopback or private bind with UDP off, an unprivileged account, and TLS and binary-protocol SASL login only on builds and clients that support them.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/memcached.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against memcached source 1.6.45 and OpenSSL CLI 3.0; 3 further sources are pinned to a commit and 4 carry no recorded version. Metadata reviewed 2026-10-15; documentation checked September 2026. The guide records 37 claims: 1 demonstrated by a check that ran and 36 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -361,23 +379,7 @@ For a binary SASL deployment, also repeat SET, GET, FLUSH, and GET through the a
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/memcached.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -442,7 +444,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-15",
"documentation_checked": "2026-09",
- "body_sha256": "77879497a23f39f20a85c1fcdb98885f433f831eaa2ed19d973079a8799d182c",
+ "body_sha256": "82b8cf0ecf7a91a0e02496521796e1f456a7443f80ac6ff38b21aa81abbf1274",
"components": {
"stable": {
"name": "memcached source",
diff --git a/plugin/skills/secure-deployment-config/references/minio.md b/plugin/skills/secure-deployment-config/references/minio.md
index b9e262132..cc7630eb5 100644
--- a/plugin/skills/secure-deployment-config/references/minio.md
+++ b/plugin/skills/secure-deployment-config/references/minio.md
@@ -1,5 +1,23 @@
# MinIO: credentials, TLS, encryption, and object protection
+MinIO (now shipped as AIStor) is object storage you run yourself: apps store files in buckets through the same API as Amazon S3. This guide helps your AI assistant configure it securely, including real root credentials, TLS, scoped application access, and encryption with a key manager.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/minio.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against AIStor documentation (no recorded version); 1 further source is pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 44 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -552,23 +570,7 @@ REASONED from the cited AIStor documentation: OIDC role-policy and claim-policy
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/minio.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -634,7 +636,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "8532b3aa69cdb790096c6fbe1ce337c046f59245c4122418832204ca3101ee94",
+ "body_sha256": "c6513da7841b2b2ceb5833dbb8b05c527d688d65babf3332b616f77ce92bedcb",
"components": {
"aistor": {
"name": "AIStor documentation",
diff --git a/plugin/skills/secure-deployment-config/references/model-servers.md b/plugin/skills/secure-deployment-config/references/model-servers.md
index 0a774f4eb..50877f8ae 100644
--- a/plugin/skills/secure-deployment-config/references/model-servers.md
+++ b/plugin/skills/secure-deployment-config/references/model-servers.md
@@ -1,5 +1,23 @@
# Model servers: llama.cpp, vLLM, TGI, SGLang, Triton, and LM Studio
+llama.cpp, vLLM, TGI, SGLang, Triton, LM Studio and text-generation-webui run AI models and answer prompts over a network API. This guide helps your AI assistant configure each securely, including a private bind, a per-client API key checked natively or by a proxy, TLS in front, and public share flags off.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/model-servers.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against llama.cpp (pinned to a commit), vLLM v0.30.0, TGI launcher/image v3.3.7, SGLang v0.5.20, and curl minimum write-out version 7.75.0; 7 further sources are pinned to a commit and 4 carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 75 claims: 3 demonstrated by a check that ran and 72 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -528,23 +546,7 @@ For cross-node endpoints in an intentionally exposed test deployment, the outsid
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/model-servers.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -654,7 +656,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "dc7078b0adb279c69f166862daf75d2ed7df8154841ffe119517de720fc237c0",
+ "body_sha256": "c5995504794d271a3afa17c309984d06bf3b3843baead15d43b4ee3d935d0ddb",
"components": {
"llama": {
"name": "llama.cpp",
diff --git a/plugin/skills/secure-deployment-config/references/mongodb.md b/plugin/skills/secure-deployment-config/references/mongodb.md
index b809745d6..47b4ec3a1 100644
--- a/plugin/skills/secure-deployment-config/references/mongodb.md
+++ b/plugin/skills/secure-deployment-config/references/mongodb.md
@@ -1,5 +1,23 @@
# MongoDB: TLS and authorization
+MongoDB is a database that stores records as flexible, JSON-like documents. This guide helps your AI assistant configure it securely, including authorization with collection-scoped application roles, a private bind, TLS for clients and cluster members, and, on MongoDB Enterprise only, auditing, diagnostic-log redaction and native storage encryption.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/mongodb.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against MongoDB bind source r8.0.32 and MongoDB documentation 8.0; 1 further source is pinned to a commit and 3 carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 81 claims: 1 demonstrated by a check that ran and 80 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -734,23 +752,7 @@ QE requires a new encrypted collection created with an `encryptedFields` definit
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/mongodb.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -856,7 +858,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "8b2445dc1e8749610ca70401436e9371ff8e3717fc36d5980a8f76e7520e47ae",
+ "body_sha256": "e82821dd0bc0e04677bf7d322ad9fa99618a81e033ff19d110a241e939490ba9",
"components": {
"bind": {
"name": "MongoDB bind source",
diff --git a/plugin/skills/secure-deployment-config/references/mosquitto.md b/plugin/skills/secure-deployment-config/references/mosquitto.md
index 93e50b1a1..a4c861e4a 100644
--- a/plugin/skills/secure-deployment-config/references/mosquitto.md
+++ b/plugin/skills/secure-deployment-config/references/mosquitto.md
@@ -1,5 +1,23 @@
# Mosquitto (MQTT): no anonymous clients, TLS listener
+Mosquitto is an MQTT broker: devices and programs publish short messages to named topics, and it passes them to whoever has subscribed. This guide helps your AI assistant make sure it is configured securely, including credentials for each device, no anonymous clients, a TLS listener, and access checked per topic.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/mosquitto.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Mosquitto v2.0.22 and v2.1.2 and Mosquitto legacy v1.6.15; 2 further sources are pinned to a commit and 2 carry no recorded version. Metadata reviewed 2026-10-05; documentation checked October 2026. The guide records 45 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -506,23 +524,7 @@ The explicit `$SYS/#` subscription should receive broker telemetry in the expose
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/mosquitto.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -593,7 +595,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-05",
"documentation_checked": "2026-10",
- "body_sha256": "73b1d3529e9fdfcd23efa56ade3bf305d2e5d39c8844da14cbcb843de2ef6dc9",
+ "body_sha256": "f4230abfb1a0cff6279347972a67fd1b425fe2baa8fb4ddb8b0f96c017d87f7b",
"components": {
"v20": {
"name": "Mosquitto",
diff --git a/plugin/skills/secure-deployment-config/references/mysql.md b/plugin/skills/secure-deployment-config/references/mysql.md
index ea83ebe23..2db09cf0b 100644
--- a/plugin/skills/secure-deployment-config/references/mysql.md
+++ b/plugin/skills/secure-deployment-config/references/mysql.md
@@ -1,5 +1,23 @@
# MySQL and MariaDB: TLS and authentication
+MySQL and MariaDB are relational databases that applications use to store their data. This guide helps your AI assistant make sure a server is configured securely: a private bind address, TLS required, scoped accounts with anonymous access removed, password validation enabled, file loading restricted, and clients connecting with verification.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/mysql.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against MySQL reference 8.4, 8.0, 9.7, and 26.7, MySQL Docker package mysql-8.4.9, and MariaDB package source mariadb-11.8.9; 2 further sources are pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 55 claims: 2 demonstrated by a check that ran and 53 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -750,23 +768,7 @@ Verification scope:
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/mysql.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -849,7 +851,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "3b7ba3deadbbecb403f8d7f1dd08cd323d71dcadc157fea97a6df766c8b1eb28",
+ "body_sha256": "eec3f21a667a9ef2e9a156f96742464a6eb8be7c86c5abe946a9b4976f0d0ba9",
"components": {
"mysql": {
"name": "MySQL reference",
diff --git a/plugin/skills/secure-deployment-config/references/n8n.md b/plugin/skills/secure-deployment-config/references/n8n.md
index f97207d51..e66259c21 100644
--- a/plugin/skills/secure-deployment-config/references/n8n.md
+++ b/plugin/skills/secure-deployment-config/references/n8n.md
@@ -1,5 +1,23 @@
# n8n: binding, TLS, and MFA
+n8n is a workflow automation tool with a web editor and webhook endpoints. This guide helps your AI assistant make sure it is configured securely: a private bind, TLS from a proxy or n8n itself, accounts with MFA, webhook authentication, and code-node execution isolated.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/n8n.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against n8n listener source n8n@2.40.6, n8n runtime source n8n@2.40.6, n8n environment policy minimum 2.18.0, n8n SSRF filter minimum 2.12.0, n8n 2.0 default exclusion source n8n@2.0.0, and n8n 1.x default exclusion source n8n@1.123.85; 2 further sources carry no recorded version. Metadata reviewed 2026-10-17; documentation checked October 2026. The guide records 29 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -130,23 +148,7 @@ curl -q -g -sS --noproxy '*' --connect-timeout 5 --max-time 10 -o /dev/null \
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/n8n.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -202,7 +204,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-17",
"documentation_checked": "2026-10",
- "body_sha256": "e6ab2c6368d6789dbe755e757ab49c02987858a1dd7f6f53731b64637310e0cc",
+ "body_sha256": "b2a8d012fa5a0129e243d83f2e6d5421340f05ecb83225898b1bb9b2e9132961",
"components": {
"server": {
"name": "n8n listener source",
diff --git a/plugin/skills/secure-deployment-config/references/nats.md b/plugin/skills/secure-deployment-config/references/nats.md
index 4f8117add..a66c1dd16 100644
--- a/plugin/skills/secure-deployment-config/references/nats.md
+++ b/plugin/skills/secure-deployment-config/references/nats.md
@@ -1,5 +1,23 @@
# NATS and JetStream: authentication, TLS, and the monitoring port
+NATS is a messaging server that passes messages between applications by subject name, and JetStream is its built-in feature for storing those messages. This guide helps your AI assistant configure a deployment securely, including required client authentication, scoped subjects, TLS, a private monitoring port, and bounded JetStream storage.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/nats.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against NATS Server v2.14.7, NATS image listener source v2.15.0, natscli v0.4.0, and Go socket source go1.26.8; 3 further sources are pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 65 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -1180,23 +1198,7 @@ REASONED: scope of the original authoring record and its shell-only evidence. Th
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/nats.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -1288,7 +1290,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "f0ed2c277c31a17bf1ab9675093049dc936f11fc2d2a8c07925c9c6fbd95d872",
+ "body_sha256": "44f2e28b39cf562f5e552741eb87c2e6c26ee81230a3540a09da3aeb481dcdaa",
"components": {
"server": {
"name": "NATS Server",
diff --git a/plugin/skills/secure-deployment-config/references/nginx.md b/plugin/skills/secure-deployment-config/references/nginx.md
index 73db0191b..da87eb2d8 100644
--- a/plugin/skills/secure-deployment-config/references/nginx.md
+++ b/plugin/skills/secure-deployment-config/references/nginx.md
@@ -1,5 +1,23 @@
# nginx: TLS and authentication
+nginx is a web server, commonly run as a reverse proxy in front of applications. This guide helps your AI assistant make sure it is configured securely: an HTTPS server block with a certificate, HTTP redirected to HTTPS, authentication required, and expensive endpoints bounded.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/nginx.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against nginx source release-1.26.3, Certbot nginx configurator v2.3.0, Authelia nginx integration v4.39.28, oauth2-proxy nginx integration v7.15.4, Apache httpd source 2.4.69, Debian apache2 packaging 2.4.69-1, HSTS specification RFC 6797, and OWASP Password Storage Cheat Sheet commit 72865b1e; 3 further sources carry no recorded version. Metadata reviewed 2026-10-17; documentation checked September 2026. The guide records 28 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -239,23 +257,7 @@ ss -tlnp # read every listener; 3000: the app itself: 127.0.0.1 only, never 0.
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/nginx.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -313,7 +315,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-17",
"documentation_checked": "2026-09",
- "body_sha256": "07eda7c75b5cada2d56a730e2c7a33df34730eec5139f55d0545aad278723811",
+ "body_sha256": "c0b31e49861f861f02aaad2b3398a3b682ae2d41f53f71f641dbc189d6d6f780",
"components": {
"nginx-source": {
"name": "nginx source",
diff --git a/plugin/skills/secure-deployment-config/references/nomad-consul.md b/plugin/skills/secure-deployment-config/references/nomad-consul.md
index dd8f15aa5..ee16f88d8 100644
--- a/plugin/skills/secure-deployment-config/references/nomad-consul.md
+++ b/plugin/skills/secure-deployment-config/references/nomad-consul.md
@@ -1,5 +1,23 @@
# Nomad and Consul: the scheduler and service-mesh APIs
+Nomad decides which machines run your jobs, and Consul is a service directory and key-value store. This guide helps your AI assistant configure the Community Edition of each securely, including private listen addresses, default-deny ACLs on every agent, Nomad TLS and gossip encryption, and only local script checks in Consul.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/nomad-consul.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Nomad Community Edition 2.0.7 and Consul Community Edition 2.0.4. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 42 claims: 13 demonstrated by a check that ran and 29 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -313,23 +331,7 @@ give the host's public address. A "connected" on a port you did not mean to expo
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/nomad-consul.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -392,7 +394,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "05ae6961d3225ec0e28ef043428dfeea38f86a7be4cfd93f6a6d58b4990f084a",
+ "body_sha256": "2bbd8a4ce0b378526374bfb530815edc031f20476a76b1bbf0cd590d0e35d9ef",
"components": {
"nomad": {
"name": "Nomad Community Edition",
diff --git a/plugin/skills/secure-deployment-config/references/object-storage.md b/plugin/skills/secure-deployment-config/references/object-storage.md
index 43bbded69..2efacddd1 100644
--- a/plugin/skills/secure-deployment-config/references/object-storage.md
+++ b/plugin/skills/secure-deployment-config/references/object-storage.md
@@ -1,5 +1,23 @@
# Object storage: S3, Cloudflare R2, Google Cloud Storage, Azure Blob, Supabase Storage
+Amazon S3, Cloudflare R2, Google Cloud Storage, Azure Blob Storage and Supabase Storage store files in buckets or, on Azure, containers. This guide helps your AI assistant configure them securely, including public access blocked for private data, per-application permissions, HTTPS enforced where supported, and short-lived signed links for sharing.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/object-storage.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Amazon S3 documentation (no recorded version); 4 further sources carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 63 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -678,23 +696,7 @@ REASONED: Historical evidence boundary; no original authoring receipts, authoriz
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/object-storage.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -781,7 +783,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "144f53a7276f2cc8a871e086cc84b0723735f429acf6d679ec60065aeaef8531",
+ "body_sha256": "7041f0cbd34c03fc6d672bcec4627cf01e04ff0a9d5c2ab383a7dd43639eb9fd",
"components": {
"s3": {
"name": "Amazon S3 documentation",
diff --git a/plugin/skills/secure-deployment-config/references/observability-components.md b/plugin/skills/secure-deployment-config/references/observability-components.md
index 36fae247d..b341d9b4e 100644
--- a/plugin/skills/secure-deployment-config/references/observability-components.md
+++ b/plugin/skills/secure-deployment-config/references/observability-components.md
@@ -1,5 +1,23 @@
# Self-hosted observability components: node_exporter, Alertmanager, Pushgateway, Jaeger, and Loki
+node_exporter, Alertmanager, Pushgateway, Jaeger and Loki are monitoring services that usually run beside Prometheus, handling host metrics, alerts, pushed metrics, traces and logs. This guide helps your AI assistant configure each securely, including private listeners, each component's TLS and authentication options switched on, and a login proxy for browsers.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/observability-components.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against node_exporter v1.12.1, Alertmanager v0.34.1, Pushgateway v1.11.3, Jaeger v2.21.0, Loki v3.7.8, Exporter toolkit v0.17.1, OpenTelemetry configtls v1.66.0, and OpenTelemetry basicauth extension v0.160.0, plus 1 more recorded basis; 3 further sources are pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 59 claims: 14 demonstrated by a check that ran and 45 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -512,23 +530,7 @@ from your own account's view of the process.
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/observability-components.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -619,7 +621,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "f45df859cb959c33bb27f11321b0c0ce89b86646e42b682ce29a8a31a314f7ae",
+ "body_sha256": "005f19103d8d98586c0210f7ab4cc5f9b4ed6e5a8ff8e08aff8e9cfe2c1688f2",
"components": {
"node": {
"name": "node_exporter",
diff --git a/plugin/skills/secure-deployment-config/references/ollama.md b/plugin/skills/secure-deployment-config/references/ollama.md
index 6b123bad3..6ef0c128f 100644
--- a/plugin/skills/secure-deployment-config/references/ollama.md
+++ b/plugin/skills/secure-deployment-config/references/ollama.md
@@ -1,5 +1,23 @@
# Ollama: it has no built-in authentication or TLS
+Ollama runs AI language models on your own machine and serves them to other apps through a local web API. This guide helps your AI assistant configure it securely, including a private listener, login, TLS and MFA at a fronting layer, model management limited to administrators, and bounded inference load.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/ollama.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Ollama v0.34.2, Docker Engine localhost boundary 28.0, and systemd v257; 1 further source is pinned to a commit and 7 carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 65 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -851,23 +869,7 @@ These commands validate configuration acceptance; they do not prove authenticati
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/ollama.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -962,7 +964,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "9ab3957a42bab62de0ca660b5a70d60cd251fdd1dd5885385764804259ab0fe8",
+ "body_sha256": "34ac518ca7b67386e0d088de717b4115b6f49aa94df5755a7d8a0d907c4e97f4",
"components": {
"ollama": {
"name": "Ollama",
diff --git a/plugin/skills/secure-deployment-config/references/open-webui.md b/plugin/skills/secure-deployment-config/references/open-webui.md
index ca48f14c9..2df4cab97 100644
--- a/plugin/skills/secure-deployment-config/references/open-webui.md
+++ b/plugin/skills/secure-deployment-config/references/open-webui.md
@@ -1,5 +1,23 @@
# Open WebUI: signup control, TLS, and MFA
+Open WebUI is a chat website you host yourself for talking to local or cloud-hosted language models. This guide helps your AI assistant configure it securely, including controlled registration, a private bind with TLS in front, authentication kept on, and restricted tools and code execution.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/open-webui.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Open WebUI (pinned to a commit) and Docker Engine localhost boundary 28.0.0; 1 further source carries no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 62 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -382,23 +400,7 @@ The native password-signin limiter is **15 attempts per 180 seconds per email ad
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/open-webui.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -482,7 +484,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "f0a5c38cca708ba4474566b366f8c9a89f4e265ed20e89cffdd87ccabe0713ab",
+ "body_sha256": "e6eb00e72d10a128963f4af6aa7f35a6edee3713ec80a492e09533e0c5395238",
"components": {
"webui": {
"name": "Open WebUI",
diff --git a/plugin/skills/secure-deployment-config/references/pocketbase.md b/plugin/skills/secure-deployment-config/references/pocketbase.md
index 89af0dc7c..7ce3b50ab 100644
--- a/plugin/skills/secure-deployment-config/references/pocketbase.md
+++ b/plugin/skills/secure-deployment-config/references/pocketbase.md
@@ -1,5 +1,23 @@
# Self-hosted backends: PocketBase and Appwrite
+PocketBase and Appwrite are self-hosted backends that give apps a database, user accounts and file storage through one API. This guide helps your AI assistant configure each securely, including private bootstrap, deliberate binding and TLS, access rules on every collection or resource, and server keys kept off clients.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/pocketbase.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against PocketBase v0.40.4, Appwrite 2.2.0, utopia-php/database 7.3.9, and curl curl-8_14_1; 2 further sources carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 75 claims: 2 demonstrated by a check that ran and 73 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -696,23 +714,7 @@ service result or deployed-bundle scan is claimed.
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/pocketbase.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -812,7 +814,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-19",
"documentation_checked": "2026-09",
- "body_sha256": "56cf568348e9a9e7890afd9133b526447b70bf593b07da5b93bedb63ce116e85",
+ "body_sha256": "1a5491a4947efad12d1c25ff16afa8a4c2dc02e0613cb404ad3b5511d57a483b",
"components": {
"pb": {
"name": "PocketBase",
diff --git a/plugin/skills/secure-deployment-config/references/postgresql.md b/plugin/skills/secure-deployment-config/references/postgresql.md
index a720b6904..1ad761589 100644
--- a/plugin/skills/secure-deployment-config/references/postgresql.md
+++ b/plugin/skills/secure-deployment-config/references/postgresql.md
@@ -1,5 +1,23 @@
# PostgreSQL: TLS and authentication
+PostgreSQL is a relational database that stores application data in tables queried with SQL. This guide helps your AI assistant make sure it is configured securely, including a private listener, TLS and SCRAM passwords for remote connections, an application role that does not own its tables, and connection logging.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/postgresql.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against PostgreSQL initdb source REL_17_11, PostgreSQL TLS minimum 12, PostgreSQL SCRAM default 14, PostgreSQL schema defaults 15, PostgreSQL membership and require_auth 16, and PostgreSQL MD5 and logging changes 18; 2 further sources are pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 46 claims: 2 demonstrated by a check that ran and 44 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -655,23 +673,7 @@ WHERE error IS NOT NULL OR NOT applied;
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/postgresql.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -745,7 +747,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "c0a10a106c69c2bc4358843a0ba962adc1a8fbc25b152175d1d7154d69aa07a4",
+ "body_sha256": "1e7cc90c02705b8569bcedf37bbc020a095a0961a6e3b2d9785c422427ee9621",
"components": {
"init": {
"name": "PostgreSQL initdb source",
diff --git a/plugin/skills/secure-deployment-config/references/rabbitmq.md b/plugin/skills/secure-deployment-config/references/rabbitmq.md
index d39b55f5b..3b055648e 100644
--- a/plugin/skills/secure-deployment-config/references/rabbitmq.md
+++ b/plugin/skills/secure-deployment-config/references/rabbitmq.md
@@ -1,5 +1,23 @@
# RabbitMQ: users, TLS listener, and the guest account
+RabbitMQ is a message broker: applications drop messages into its queues, and it delivers them to programs that process them. This guide helps your AI assistant configure it securely, including real users instead of the default guest account, a TLS listener, a protected management UI, and restricted Erlang distribution ports.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/rabbitmq.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against RabbitMQ source v4.3.6, rabbitmqadmin v2, RabbitMQ topic authorization introduction 3.7.0, and Erlang/OTP distribution 27; 2 further sources are pinned to a commit and 3 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 35 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -646,23 +664,7 @@ The write pattern gates publishing and the read pattern gates the routing keys a
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/rabbitmq.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -725,7 +727,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "02208e1c7164f30bd94a7488df842c3d2b5709113cd61925722fae35b7159460",
+ "body_sha256": "ef36f39217b1d41b9b928bce531c4cb6f6cbd1edc4978eecf39ba217dc47196c",
"components": {
"source": {
"name": "RabbitMQ source",
diff --git a/plugin/skills/secure-deployment-config/references/ray.md b/plugin/skills/secure-deployment-config/references/ray.md
index acb300bdc..5dd51d71e 100644
--- a/plugin/skills/secure-deployment-config/references/ray.md
+++ b/plugin/skills/secure-deployment-config/references/ray.md
@@ -1,5 +1,23 @@
# Ray: dashboard, Jobs, and Client ports execute code
+Ray is a framework for spreading Python work across machines. This guide helps your AI assistant configure a cluster securely, including dashboard access over SSH, a tailnet or an authenticating TLS proxy, network isolation as the main boundary, and token authentication on Ray 2.52.0 and later as extra protection.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/ray.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Ray pinned source ray-2.58.0, Ray token authentication introduction 2.52.0, KubeRay chart v1.7.0, KubeRay authentication source v1.6.0, KubeRay prior RayCluster types v1.5.0, CPython WSGI server v3.11.0, and curl minimum write-out version 7.75.0; 1 further source is pinned to a commit and 5 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 46 claims: 1 demonstrated by a check that ran and 45 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -304,23 +322,7 @@ REASONED: mixed historical listener observations and unrun service comparisons f
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/ray.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -398,7 +400,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "286cb3508e87ad0658bd57c73270ab3b4100681250bae339f4d71a573e537bfb",
+ "body_sha256": "ecf05a76c43042bce13d9c3d1551edf5b8e4887d5ce398c53fb1a8a3eb7ac9f3",
"components": {
"ray": {
"name": "Ray pinned source",
diff --git a/plugin/skills/secure-deployment-config/references/realtime-voice-infra.md b/plugin/skills/secure-deployment-config/references/realtime-voice-infra.md
index b74cde4c6..81f64d38b 100644
--- a/plugin/skills/secure-deployment-config/references/realtime-voice-infra.md
+++ b/plugin/skills/secure-deployment-config/references/realtime-voice-infra.md
@@ -1,5 +1,23 @@
# Realtime voice and video infrastructure: LiveKit and coturn
+LiveKit and coturn are media servers for live calls: LiveKit routes media between participants, and coturn relays media when devices cannot connect directly. This guide helps your AI assistant configure both securely, including strong LiveKit signing secrets, no development mode, TLS for signaling, and authenticated coturn with restricted relay destinations.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/realtime-voice-infra.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against LiveKit v1.13.7, livekit-cli v2.18.2, coturn 4.18.0, coturn DTLS opt-in introduction 4.17.0, curl minimum write-out version 7.75.0, OpenSSL CLI 3.0, and OpenSSL dgst 3.5; 1 further source is pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-10-12; documentation checked September 2026. The guide records 50 claims: 1 demonstrated by a check that ran and 49 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -332,23 +350,7 @@ REASONED: preceding block; what a deployment run of the s_client command does no
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/realtime-voice-infra.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -426,7 +428,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-12",
"documentation_checked": "2026-09",
- "body_sha256": "6bb6465c85da42813ed04f5b54eca18e250842363c68a5e60b4bb5ca0a9e72fc",
+ "body_sha256": "df59b1ac737e19a27ff0902375ec1de5745e752c20b83783e18c0fb8a172d023",
"components": {
"livekit": {
"name": "LiveKit",
diff --git a/plugin/skills/secure-deployment-config/references/realtime-webhooks.md b/plugin/skills/secure-deployment-config/references/realtime-webhooks.md
index 5823d7062..014c02705 100644
--- a/plugin/skills/secure-deployment-config/references/realtime-webhooks.md
+++ b/plugin/skills/secure-deployment-config/references/realtime-webhooks.md
@@ -1,5 +1,23 @@
# WebSockets, server-sent events, and webhooks: authenticating the non-page endpoints
+WebSockets and server-sent events keep a connection open so a server can stream data to the browser; webhooks are requests other services send to notify your app. This guide helps your AI assistant secure these endpoints, including authenticated streams, verified webhook senders, bounded expensive endpoints, and restricted relay destinations.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/realtime-webhooks.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against WebSocket protocol RFC 6455, stripe-node v18.5.0, stripe-python v12.5.0, Traefik timeout reference v3.5, Caddy source v2.11.4, nginx source release-1.26.3, HAProxy 3.0, and HAProxy source v3.0.0, plus 1 more recorded basis; 7 further sources carry no recorded version. Metadata reviewed 2026-10-17; documentation checked September 2026. The guide records 36 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -247,23 +265,7 @@ Scope and revisions: browser behavior follows RFC 6455 and the HTML and Fetch li
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/realtime-webhooks.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -334,7 +336,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-17",
"documentation_checked": "2026-09",
- "body_sha256": "388feba84d8550e0fcda92145b4191091a4b2d2f17912f63bc753f9d7c00972c",
+ "body_sha256": "fbd1d55ce98188ac445231ccf908356fd6a89d142e6eaa4191eea28c7eebfc48",
"components": {
"websocket": {
"name": "WebSocket protocol",
diff --git a/plugin/skills/secure-deployment-config/references/redis.md b/plugin/skills/secure-deployment-config/references/redis.md
index 8a3aa0086..a5d16e51f 100644
--- a/plugin/skills/secure-deployment-config/references/redis.md
+++ b/plugin/skills/secure-deployment-config/references/redis.md
@@ -1,5 +1,23 @@
# Redis: TLS and authentication
+Redis is an in-memory data store used as a cache, key-value database or message channel. This guide helps your AI assistant configure it securely, including a local bind unless remote access is deliberate, a required credential, locked-down runtime commands, and TLS where server and client are built with it.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/redis.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Redis configuration 6.0.20, 6.2.14, 6.2.0, 7.0.15, 8.2.1, and 8.6.0, Redis HA source 8.10.1, Redis image tag v8.10.2, and Redis compiled defaults 7.4.8 and 8.10.2; 1 further source is pinned to a commit and 3 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 59 claims: 1 demonstrated by a check that ran and 58 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -827,23 +845,7 @@ The tagged configuration files below pin syntax and historical behaviour; they a
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/redis.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -935,7 +937,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "bdd2c88e86e24637097c57f8abfd523f83b1044fefe1d7d33aaddd94532315e6",
+ "body_sha256": "58a7f8f6163790b93cb5733b18b3bc572500b09eb588bdf38b61363840f1ded4",
"components": {
"r60": {
"name": "Redis configuration",
diff --git a/plugin/skills/secure-deployment-config/references/search-engines.md b/plugin/skills/secure-deployment-config/references/search-engines.md
index 37a09bba1..e991c8de6 100644
--- a/plugin/skills/secure-deployment-config/references/search-engines.md
+++ b/plugin/skills/secure-deployment-config/references/search-engines.md
@@ -1,5 +1,23 @@
# Search engines for RAG: Meilisearch and Typesense
+Meilisearch and Typesense are search engines that index your documents and answer search queries over HTTP. This guide helps your AI assistant configure each securely, including a master or bootstrap key that stays on the server, scoped keys for search clients, private listeners, and TLS from a fronting proxy.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/search-engines.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Meilisearch release reference v1.53.2, Typesense 30.2, Caddy v2.11.4, curl minimum 7.75.0, Git grep manual 2.55.0, Git rev-list manual 2.56.0, and Git manual 2.56.0; 4 further sources carry no recorded version. Metadata reviewed 2026-10-12; documentation checked October 2026. The guide records 30 claims: 10 demonstrated by a check that ran and 20 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -252,23 +270,7 @@ Version scope: Typesense 30.2; Meilisearch current unversioned documentation che
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/search-engines.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -328,7 +330,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-12",
"documentation_checked": "2026-10",
- "body_sha256": "98bf2bbbb774a4c7e71ec7f07b9035b6127771baa4c953d0b35d251f59f0b34c",
+ "body_sha256": "73a2ed139255dbf7d9b8fd1266d7f4be08bf7ef645f16c82af65a4a7ac8cb536",
"components": {
"meili": {
"name": "Meilisearch release reference",
diff --git a/plugin/skills/secure-deployment-config/references/self-hosted-ci-runners.md b/plugin/skills/secure-deployment-config/references/self-hosted-ci-runners.md
index fc8863802..468193395 100644
--- a/plugin/skills/secure-deployment-config/references/self-hosted-ci-runners.md
+++ b/plugin/skills/secure-deployment-config/references/self-hosted-ci-runners.md
@@ -1,5 +1,23 @@
# Self-hosted CI runners: GitHub Actions and GitLab Runner
+GitHub Actions self-hosted runners and GitLab Runner run CI jobs on machines you manage. This guide helps your AI assistant configure runners securely, including limits on whose code can start jobs, untrusted jobs on isolated disposable workers apart from deployment runners, narrow credentials, and egress enforced outside the job.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/self-hosted-ci-runners.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against GitHub Actions documentation (no recorded version), GitHub REST API 2026-03-10, and Python tomllib minimum 3.11; 3 further sources carry no recorded version. Metadata reviewed 2026-10-12; documentation checked September 2026. The guide records 37 claims: 1 demonstrated by a check that ran and 36 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -279,23 +297,7 @@ Version boundary: GitHub.com documentation checked 18 September 2026, with REST
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/self-hosted-ci-runners.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -357,7 +359,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-12",
"documentation_checked": "2026-09",
- "body_sha256": "72e6c5e6e8aa98cd95989f98eb383a327daaecd20809fcb2d24aea181dee4f4e",
+ "body_sha256": "b6f0a62c993bb4e0b4f09ddd47a88c26c7f4aa976af303c778de05d1c17f8fd4",
"components": {
"github": {
"name": "GitHub Actions documentation",
diff --git a/plugin/skills/secure-deployment-config/references/self-hosted-error-trackers.md b/plugin/skills/secure-deployment-config/references/self-hosted-error-trackers.md
index 0e5de6b90..ecc09c78e 100644
--- a/plugin/skills/secure-deployment-config/references/self-hosted-error-trackers.md
+++ b/plugin/skills/secure-deployment-config/references/self-hosted-error-trackers.md
@@ -1,5 +1,23 @@
# Self-hosted error trackers: Sentry and GlitchTip
+Sentry and GlitchTip are error trackers: apps send them crash reports with stack traces and request details. This guide helps your AI assistant configure an instance securely, including a loopback bind behind a TLS proxy, open sign-up off (GlitchTip ships it on), required MFA, and unpublished backing stores.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/self-hosted-error-trackers.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Sentry and self-hosted distribution 26.8.0 and GlitchTip backend v6.2.6; 3 further sources carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 23 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -130,23 +148,7 @@ Point that block at Sentry's `http://tracker.example.com:9000/`: because the bun
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/self-hosted-error-trackers.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -193,7 +195,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "a1352e0b28964f85a1f3a0de1c89e5e95afe80e0a6386c794e57ee88b70a1138",
+ "body_sha256": "3352bcdbc8350cf1e4966038e3e9531acf00baa3cf839fd59dff973a9bb555e9",
"components": {
"sentry": {
"name": "Sentry and self-hosted distribution",
diff --git a/plugin/skills/secure-deployment-config/references/streamlit.md b/plugin/skills/secure-deployment-config/references/streamlit.md
index 0d85eacf6..4d6c7ed31 100644
--- a/plugin/skills/secure-deployment-config/references/streamlit.md
+++ b/plugin/skills/secure-deployment-config/references/streamlit.md
@@ -1,5 +1,23 @@
# Streamlit: TLS and authentication
+Streamlit is a Python library that turns data scripts into interactive web apps. This guide helps your AI assistant configure an app securely, including a loopback bind with TLS from a proxy or tunnel, a native OIDC login or an authenticating proxy, and reviewed uploads, static files and outbound traffic.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/streamlit.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Streamlit 1.64.0, Google OpenID Connect documentation rolling documentation, checked 2026-10-15, Authlib minimum 1.3.2, httpx minimum 0.24.1, Caddy v2.11.4, oauth2-proxy v7.15.4, Keycloak 26.7.4, and curl minimum write-out version 7.75.0; 3 further sources carry no recorded version. Metadata reviewed 2026-10-05; documentation checked October 2026. The guide records 35 claims: 12 demonstrated by a check that ran and 23 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -215,23 +233,7 @@ Source-checked on 2026-09-18 against Streamlit 1.64.0, the current release at th
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/streamlit.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -296,7 +298,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-05",
"documentation_checked": "2026-10",
- "body_sha256": "8f1af50b58ec9e65f321989751e1ee7d32e9d068e8bbd945a9fe571806ce9449",
+ "body_sha256": "c83bdc30997ec7651c814a21832622c8369ec43b9752c05c4a1130ac0e5a9f10",
"components": {
"streamlit": {
"name": "Streamlit",
diff --git a/plugin/skills/secure-deployment-config/references/supabase-self-hosted.md b/plugin/skills/secure-deployment-config/references/supabase-self-hosted.md
index 56ef4f369..bc2662076 100644
--- a/plugin/skills/secure-deployment-config/references/supabase-self-hosted.md
+++ b/plugin/skills/secure-deployment-config/references/supabase-self-hosted.md
@@ -1,5 +1,23 @@
# Self-hosted Supabase
+Supabase is an app backend that bundles a PostgreSQL database with sign-in, file storage and ready-made APIs. This guide helps your AI assistant configure a self-hosted Docker deployment securely, including every demo secret replaced before first start, published ports kept off the internet, and the `service_role` key guarded.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/supabase-self-hosted.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Supabase documentation (no recorded version) and curl curl-8_14_1; 4 further sources are pinned to a commit. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 28 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -187,23 +205,7 @@ The guide's `self-hosted/v0.8.1` version basis cites Compose at e693f206f5050b00
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/supabase-self-hosted.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -256,7 +258,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "7b148279d78c4f1bf31d47ab41b3c410c6840c43048393bba146da2d7184ac16",
+ "body_sha256": "283db5908cbcf4fb805283e12ff21328493cdaf4bd35382fcac2e71df553a225",
"components": {
"docs": {
"name": "Supabase documentation",
diff --git a/plugin/skills/secure-deployment-config/references/time-series-metrics-stores.md b/plugin/skills/secure-deployment-config/references/time-series-metrics-stores.md
index 573ae4cff..0c1de5e71 100644
--- a/plugin/skills/secure-deployment-config/references/time-series-metrics-stores.md
+++ b/plugin/skills/secure-deployment-config/references/time-series-metrics-stores.md
@@ -1,5 +1,23 @@
# Time-series and metrics stores: InfluxDB, VictoriaMetrics, and QuestDB
+InfluxDB, VictoriaMetrics and QuestDB are time-series databases: they store readings over time, like server metrics. This guide helps your AI assistant configure each securely, including InfluxDB 2.x setup finished privately and applications given scoped tokens, VictoriaMetrics cluster RPC ports limited to cluster members, and QuestDB's default database login changed.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/time-series-metrics-stores.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against InfluxDB OSS 2.x and 1.x, VictoriaMetrics single-node v1.152.0, VictoriaMetrics cluster v1.152.0-cluster, VictoriaMetrics shipped Compose image v1.151.0, and QuestDB Enterprise qualification 4.0.0; 2 further sources are pinned to a commit and 2 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 45 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -214,23 +232,7 @@ REASONED: the VictoriaMetrics v1.152.0 single-node endpoint-key and Basic-auth c
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/time-series-metrics-stores.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -304,7 +306,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "e0da00137fe67ffece497c6157594e02a012c12e44d704253e4499707b36dc02",
+ "body_sha256": "c23bb50631d831bd18048dc9ccf27e744b89cd79d044c0023ea923a2ce381c72",
"components": {
"influx2": {
"name": "InfluxDB OSS",
diff --git a/plugin/skills/secure-deployment-config/references/vault.md b/plugin/skills/secure-deployment-config/references/vault.md
index 45a559215..dd72f5001 100644
--- a/plugin/skills/secure-deployment-config/references/vault.md
+++ b/plugin/skills/secure-deployment-config/references/vault.md
@@ -1,5 +1,23 @@
# HashiCorp Vault
+HashiCorp Vault is a secrets manager: applications fetch passwords, API keys and other credentials from it instead of keeping them in files. This guide helps your AI assistant make sure it is configured securely, including no dev mode in production, an enabled audit device, and narrowly scoped policies and tokens.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/vault.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Vault loopback run 2.1.1, Vault handler source v1.21.0, Vault forwarding source v1.20.0, Vault JWT audience minimum 1.17, Vault historical wrapping qualification 0.8, and curl minimum write-out version 7.75.0; 1 further source carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 36 claims: 16 demonstrated by a check that ran and 20 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -1147,23 +1165,7 @@ See [production firewall guidance](https://developer.hashicorp.com/vault/docs/co
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/vault.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -1225,7 +1227,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "c0cc4cc8e447a97ecaf2d7468cc3b61f66ab601a32ecad3bd7ff8c892b95d894",
+ "body_sha256": "0bf7df3cd09be317f048df09313fb31631bc814a65264b021f701896d207297a",
"components": {
"run": {
"name": "Vault loopback run",
diff --git a/plugin/skills/secure-deployment-config/references/vector-databases.md b/plugin/skills/secure-deployment-config/references/vector-databases.md
index 46d8abe2c..ea1733eab 100644
--- a/plugin/skills/secure-deployment-config/references/vector-databases.md
+++ b/plugin/skills/secure-deployment-config/references/vector-databases.md
@@ -1,5 +1,23 @@
# Vector databases: Qdrant, Weaviate, Milvus, Chroma, pgvector
+Qdrant, Weaviate, Milvus and Chroma are vector databases that find text by meaning; pgvector adds this to PostgreSQL. This guide helps your AI assistant configure each securely, including Weaviate's anonymous access off, Milvus's default root password changed, and Chroma behind an authenticated TLS proxy, Cloudflare Tunnel with Access or tailnet.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/vector-databases.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Qdrant source v1.19.1, Weaviate source v1.39.6, Milvus v2.6.24 and v3.0.2, Milvus Helm chart 5.0.30, Milvus Operator v1.3.11, Chroma source 1.5.9, Chroma migration documentation v1.0.0, and pgvector source v0.8.2, plus 5 more recorded bases; 8 further sources carry no recorded version. Metadata reviewed 2026-10-15; documentation checked September 2026. The guide records 55 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -278,23 +296,7 @@ REASONED: tenant isolation and bypass positive control. A live PostgreSQL with p
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/vector-databases.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -391,7 +393,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-15",
"documentation_checked": "2026-09",
- "body_sha256": "83c865153d5158fab30da3bb303117817f1cd6c1b1471dc48e0fbac05ec35363",
+ "body_sha256": "fc2918727d64bf41798db38364a7e8b86163fc4fb056a85b4a6cb21e3f26663b",
"components": {
"q": {
"name": "Qdrant source",
diff --git a/plugin/skills/secure-deployment-config/references/workflow-orchestrators.md b/plugin/skills/secure-deployment-config/references/workflow-orchestrators.md
index c7194aa11..d63cbca12 100644
--- a/plugin/skills/secure-deployment-config/references/workflow-orchestrators.md
+++ b/plugin/skills/secure-deployment-config/references/workflow-orchestrators.md
@@ -1,5 +1,23 @@
# Workflow and agent orchestrators: Prefect, Dagster, Airflow, Temporal, Flower, Argo
+Prefect, Dagster, Airflow, Temporal, Flower and Argo Workflows schedule, run or monitor jobs and pipelines, and their consoles and APIs can start code on workers. This guide helps your AI assistant configure each securely, including no public UI or API, MFA for people, separate machine-client credentials, and limited worker egress.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/workflow-orchestrators.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Prefect Basic Auth minimum 3.1.8, Dagster OSS 1.13.24, Apache Airflow 3.3.2, Temporal Go SDK codec source v1.28.0, Flower v2.2.0, Argo Workflows v3.7.18 and v4.1.4, Prefect Blocks source 3.1.8, and Apache Airflow historical configuration 2.11.0, plus 10 more recorded bases; 1 further source is pinned to a commit and 7 carry no recorded version. Metadata reviewed 2026-10-05; documentation checked October 2026. The guide records 62 claims: 3 demonstrated by a check that ran and 59 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -481,23 +499,7 @@ These defaults are checked against Prefect 3.1.8+ for Basic Auth, Dagster 1.13.x
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/workflow-orchestrators.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -605,7 +607,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-05",
"documentation_checked": "2026-10",
- "body_sha256": "fa18bb5bca5189881826e754d7d45b7a5179143b73c35dd0f654f46b3e7945b1",
+ "body_sha256": "d7680e74130e76721e3b4643260c974dab37029d366f90766e8bce403743319d",
"components": {
"prefect": {
"name": "Prefect Basic Auth minimum",
diff --git a/pocketbase.md b/pocketbase.md
index 89af0dc7c..7ce3b50ab 100644
--- a/pocketbase.md
+++ b/pocketbase.md
@@ -1,5 +1,23 @@
# Self-hosted backends: PocketBase and Appwrite
+PocketBase and Appwrite are self-hosted backends that give apps a database, user accounts and file storage through one API. This guide helps your AI assistant configure each securely, including private bootstrap, deliberate binding and TLS, access rules on every collection or resource, and server keys kept off clients.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/pocketbase.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against PocketBase v0.40.4, Appwrite 2.2.0, utopia-php/database 7.3.9, and curl curl-8_14_1; 2 further sources carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 75 claims: 2 demonstrated by a check that ran and 73 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -696,23 +714,7 @@ service result or deployed-bundle scan is claimed.
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/pocketbase.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -812,7 +814,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-19",
"documentation_checked": "2026-09",
- "body_sha256": "56cf568348e9a9e7890afd9133b526447b70bf593b07da5b93bedb63ce116e85",
+ "body_sha256": "1a5491a4947efad12d1c25ff16afa8a4c2dc02e0613cb404ad3b5511d57a483b",
"components": {
"pb": {
"name": "PocketBase",
diff --git a/postgresql.md b/postgresql.md
index a720b6904..1ad761589 100644
--- a/postgresql.md
+++ b/postgresql.md
@@ -1,5 +1,23 @@
# PostgreSQL: TLS and authentication
+PostgreSQL is a relational database that stores application data in tables queried with SQL. This guide helps your AI assistant make sure it is configured securely, including a private listener, TLS and SCRAM passwords for remote connections, an application role that does not own its tables, and connection logging.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/postgresql.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against PostgreSQL initdb source REL_17_11, PostgreSQL TLS minimum 12, PostgreSQL SCRAM default 14, PostgreSQL schema defaults 15, PostgreSQL membership and require_auth 16, and PostgreSQL MD5 and logging changes 18; 2 further sources are pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 46 claims: 2 demonstrated by a check that ran and 44 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -655,23 +673,7 @@ WHERE error IS NOT NULL OR NOT applied;
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/postgresql.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -745,7 +747,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "c0a10a106c69c2bc4358843a0ba962adc1a8fbc25b152175d1d7154d69aa07a4",
+ "body_sha256": "1e7cc90c02705b8569bcedf37bbc020a095a0961a6e3b2d9785c422427ee9621",
"components": {
"init": {
"name": "PostgreSQL initdb source",
diff --git a/rabbitmq.md b/rabbitmq.md
index d39b55f5b..3b055648e 100644
--- a/rabbitmq.md
+++ b/rabbitmq.md
@@ -1,5 +1,23 @@
# RabbitMQ: users, TLS listener, and the guest account
+RabbitMQ is a message broker: applications drop messages into its queues, and it delivers them to programs that process them. This guide helps your AI assistant configure it securely, including real users instead of the default guest account, a TLS listener, a protected management UI, and restricted Erlang distribution ports.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/rabbitmq.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against RabbitMQ source v4.3.6, rabbitmqadmin v2, RabbitMQ topic authorization introduction 3.7.0, and Erlang/OTP distribution 27; 2 further sources are pinned to a commit and 3 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 35 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -646,23 +664,7 @@ The write pattern gates publishing and the read pattern gates the routing keys a
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/rabbitmq.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -725,7 +727,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "02208e1c7164f30bd94a7488df842c3d2b5709113cd61925722fae35b7159460",
+ "body_sha256": "ef36f39217b1d41b9b928bce531c4cb6f6cbd1edc4978eecf39ba217dc47196c",
"components": {
"source": {
"name": "RabbitMQ source",
diff --git a/ray.md b/ray.md
index acb300bdc..5dd51d71e 100644
--- a/ray.md
+++ b/ray.md
@@ -1,5 +1,23 @@
# Ray: dashboard, Jobs, and Client ports execute code
+Ray is a framework for spreading Python work across machines. This guide helps your AI assistant configure a cluster securely, including dashboard access over SSH, a tailnet or an authenticating TLS proxy, network isolation as the main boundary, and token authentication on Ray 2.52.0 and later as extra protection.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/ray.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Ray pinned source ray-2.58.0, Ray token authentication introduction 2.52.0, KubeRay chart v1.7.0, KubeRay authentication source v1.6.0, KubeRay prior RayCluster types v1.5.0, CPython WSGI server v3.11.0, and curl minimum write-out version 7.75.0; 1 further source is pinned to a commit and 5 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 46 claims: 1 demonstrated by a check that ran and 45 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -304,23 +322,7 @@ REASONED: mixed historical listener observations and unrun service comparisons f
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/ray.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -398,7 +400,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "286cb3508e87ad0658bd57c73270ab3b4100681250bae339f4d71a573e537bfb",
+ "body_sha256": "ecf05a76c43042bce13d9c3d1551edf5b8e4887d5ce398c53fb1a8a3eb7ac9f3",
"components": {
"ray": {
"name": "Ray pinned source",
diff --git a/realtime-voice-infra.md b/realtime-voice-infra.md
index b74cde4c6..81f64d38b 100644
--- a/realtime-voice-infra.md
+++ b/realtime-voice-infra.md
@@ -1,5 +1,23 @@
# Realtime voice and video infrastructure: LiveKit and coturn
+LiveKit and coturn are media servers for live calls: LiveKit routes media between participants, and coturn relays media when devices cannot connect directly. This guide helps your AI assistant configure both securely, including strong LiveKit signing secrets, no development mode, TLS for signaling, and authenticated coturn with restricted relay destinations.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/realtime-voice-infra.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against LiveKit v1.13.7, livekit-cli v2.18.2, coturn 4.18.0, coturn DTLS opt-in introduction 4.17.0, curl minimum write-out version 7.75.0, OpenSSL CLI 3.0, and OpenSSL dgst 3.5; 1 further source is pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-10-12; documentation checked September 2026. The guide records 50 claims: 1 demonstrated by a check that ran and 49 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -332,23 +350,7 @@ REASONED: preceding block; what a deployment run of the s_client command does no
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/realtime-voice-infra.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -426,7 +428,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-12",
"documentation_checked": "2026-09",
- "body_sha256": "6bb6465c85da42813ed04f5b54eca18e250842363c68a5e60b4bb5ca0a9e72fc",
+ "body_sha256": "df59b1ac737e19a27ff0902375ec1de5745e752c20b83783e18c0fb8a172d023",
"components": {
"livekit": {
"name": "LiveKit",
diff --git a/realtime-webhooks.md b/realtime-webhooks.md
index 5823d7062..014c02705 100644
--- a/realtime-webhooks.md
+++ b/realtime-webhooks.md
@@ -1,5 +1,23 @@
# WebSockets, server-sent events, and webhooks: authenticating the non-page endpoints
+WebSockets and server-sent events keep a connection open so a server can stream data to the browser; webhooks are requests other services send to notify your app. This guide helps your AI assistant secure these endpoints, including authenticated streams, verified webhook senders, bounded expensive endpoints, and restricted relay destinations.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/realtime-webhooks.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against WebSocket protocol RFC 6455, stripe-node v18.5.0, stripe-python v12.5.0, Traefik timeout reference v3.5, Caddy source v2.11.4, nginx source release-1.26.3, HAProxy 3.0, and HAProxy source v3.0.0, plus 1 more recorded basis; 7 further sources carry no recorded version. Metadata reviewed 2026-10-17; documentation checked September 2026. The guide records 36 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -247,23 +265,7 @@ Scope and revisions: browser behavior follows RFC 6455 and the HTML and Fetch li
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/realtime-webhooks.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -334,7 +336,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-17",
"documentation_checked": "2026-09",
- "body_sha256": "388feba84d8550e0fcda92145b4191091a4b2d2f17912f63bc753f9d7c00972c",
+ "body_sha256": "fbd1d55ce98188ac445231ccf908356fd6a89d142e6eaa4191eea28c7eebfc48",
"components": {
"websocket": {
"name": "WebSocket protocol",
diff --git a/redis.md b/redis.md
index 8a3aa0086..a5d16e51f 100644
--- a/redis.md
+++ b/redis.md
@@ -1,5 +1,23 @@
# Redis: TLS and authentication
+Redis is an in-memory data store used as a cache, key-value database or message channel. This guide helps your AI assistant configure it securely, including a local bind unless remote access is deliberate, a required credential, locked-down runtime commands, and TLS where server and client are built with it.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/redis.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Redis configuration 6.0.20, 6.2.14, 6.2.0, 7.0.15, 8.2.1, and 8.6.0, Redis HA source 8.10.1, Redis image tag v8.10.2, and Redis compiled defaults 7.4.8 and 8.10.2; 1 further source is pinned to a commit and 3 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 59 claims: 1 demonstrated by a check that ran and 58 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -827,23 +845,7 @@ The tagged configuration files below pin syntax and historical behaviour; they a
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/redis.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -935,7 +937,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "bdd2c88e86e24637097c57f8abfd523f83b1044fefe1d7d33aaddd94532315e6",
+ "body_sha256": "58a7f8f6163790b93cb5733b18b3bc572500b09eb588bdf38b61363840f1ded4",
"components": {
"r60": {
"name": "Redis configuration",
diff --git a/search-engines.md b/search-engines.md
index 37a09bba1..e991c8de6 100644
--- a/search-engines.md
+++ b/search-engines.md
@@ -1,5 +1,23 @@
# Search engines for RAG: Meilisearch and Typesense
+Meilisearch and Typesense are search engines that index your documents and answer search queries over HTTP. This guide helps your AI assistant configure each securely, including a master or bootstrap key that stays on the server, scoped keys for search clients, private listeners, and TLS from a fronting proxy.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/search-engines.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Meilisearch release reference v1.53.2, Typesense 30.2, Caddy v2.11.4, curl minimum 7.75.0, Git grep manual 2.55.0, Git rev-list manual 2.56.0, and Git manual 2.56.0; 4 further sources carry no recorded version. Metadata reviewed 2026-10-12; documentation checked October 2026. The guide records 30 claims: 10 demonstrated by a check that ran and 20 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -252,23 +270,7 @@ Version scope: Typesense 30.2; Meilisearch current unversioned documentation che
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/search-engines.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -328,7 +330,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-12",
"documentation_checked": "2026-10",
- "body_sha256": "98bf2bbbb774a4c7e71ec7f07b9035b6127771baa4c953d0b35d251f59f0b34c",
+ "body_sha256": "73a2ed139255dbf7d9b8fd1266d7f4be08bf7ef645f16c82af65a4a7ac8cb536",
"components": {
"meili": {
"name": "Meilisearch release reference",
diff --git a/self-hosted-ci-runners.md b/self-hosted-ci-runners.md
index fc8863802..468193395 100644
--- a/self-hosted-ci-runners.md
+++ b/self-hosted-ci-runners.md
@@ -1,5 +1,23 @@
# Self-hosted CI runners: GitHub Actions and GitLab Runner
+GitHub Actions self-hosted runners and GitLab Runner run CI jobs on machines you manage. This guide helps your AI assistant configure runners securely, including limits on whose code can start jobs, untrusted jobs on isolated disposable workers apart from deployment runners, narrow credentials, and egress enforced outside the job.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/self-hosted-ci-runners.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against GitHub Actions documentation (no recorded version), GitHub REST API 2026-03-10, and Python tomllib minimum 3.11; 3 further sources carry no recorded version. Metadata reviewed 2026-10-12; documentation checked September 2026. The guide records 37 claims: 1 demonstrated by a check that ran and 36 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -279,23 +297,7 @@ Version boundary: GitHub.com documentation checked 18 September 2026, with REST
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/self-hosted-ci-runners.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -357,7 +359,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-12",
"documentation_checked": "2026-09",
- "body_sha256": "72e6c5e6e8aa98cd95989f98eb383a327daaecd20809fcb2d24aea181dee4f4e",
+ "body_sha256": "b6f0a62c993bb4e0b4f09ddd47a88c26c7f4aa976af303c778de05d1c17f8fd4",
"components": {
"github": {
"name": "GitHub Actions documentation",
diff --git a/self-hosted-error-trackers.md b/self-hosted-error-trackers.md
index 0e5de6b90..ecc09c78e 100644
--- a/self-hosted-error-trackers.md
+++ b/self-hosted-error-trackers.md
@@ -1,5 +1,23 @@
# Self-hosted error trackers: Sentry and GlitchTip
+Sentry and GlitchTip are error trackers: apps send them crash reports with stack traces and request details. This guide helps your AI assistant configure an instance securely, including a loopback bind behind a TLS proxy, open sign-up off (GlitchTip ships it on), required MFA, and unpublished backing stores.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/self-hosted-error-trackers.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Sentry and self-hosted distribution 26.8.0 and GlitchTip backend v6.2.6; 3 further sources carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 23 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -130,23 +148,7 @@ Point that block at Sentry's `http://tracker.example.com:9000/`: because the bun
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/self-hosted-error-trackers.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -193,7 +195,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "a1352e0b28964f85a1f3a0de1c89e5e95afe80e0a6386c794e57ee88b70a1138",
+ "body_sha256": "3352bcdbc8350cf1e4966038e3e9531acf00baa3cf839fd59dff973a9bb555e9",
"components": {
"sentry": {
"name": "Sentry and self-hosted distribution",
diff --git a/site/llms-full.txt b/site/llms-full.txt
index 44f6f2db1..ad96a709f 100644
--- a/site/llms-full.txt
+++ b/site/llms-full.txt
@@ -3889,6 +3889,24 @@ Claims (full source mapping in the JSON block below):
# HashiCorp Vault
+HashiCorp Vault is a secrets manager: applications fetch passwords, API keys and other credentials from it instead of keeping them in files. This guide helps your AI assistant make sure it is configured securely, including no dev mode in production, an enabled audit device, and narrowly scoped policies and tokens.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/vault.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Vault loopback run 2.1.1, Vault handler source v1.21.0, Vault forwarding source v1.20.0, Vault JWT audience minimum 1.17, Vault historical wrapping qualification 0.8, and curl minimum write-out version 7.75.0; 1 further source carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 36 claims: 16 demonstrated by a check that ran and 20 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -5036,23 +5054,7 @@ See [production firewall guidance](https://developer.hashicorp.com/vault/docs/co
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/vault.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -5114,7 +5116,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "c0cc4cc8e447a97ecaf2d7468cc3b61f66ab601a32ecad3bd7ff8c892b95d894",
+ "body_sha256": "0bf7df3cd09be317f048df09313fb31631bc814a65264b021f701896d207297a",
"components": {
"run": {
"name": "Vault loopback run",
@@ -8188,6 +8190,24 @@ Claims (full source mapping in the JSON block below):
# Apache HTTP Server: TLS and authentication
+Apache HTTP Server is a web server for serving sites over HTTP and HTTPS. This guide helps your AI assistant make sure it is configured securely: the TLS modules enabled, an HTTPS virtual host configured, HTTP redirected to HTTPS, and authentication required where needed.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/apache.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Apache HTTP Server 2.4, Apache TLSv1.3 minimum 2.4.36+, Apache per-vhost protocol minimum 2.4.42+, Apache chain-file minimum 2.4.8, httpd htpasswd 2.4.69, OpenSSL qualification 1.1.1+, Certbot Apache installation v2.3.0, and Debian apache2 packaging 2.4.69-1, plus 5 more recorded bases; 1 further source carries no recorded version. Metadata reviewed 2026-10-18; documentation checked September 2026. The guide records 20 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -8353,23 +8373,7 @@ sudo apachectl -S # the vhost list, in Apache's own matchi
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/apache.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -8422,7 +8426,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-18",
"documentation_checked": "2026-09",
- "body_sha256": "645f3f5ab27a4df2af69e0680ac8e98f85ca416fe85a078c95075598e9b33f4d",
+ "body_sha256": "1337f946ff115e07d47b82d92b16b180220ad1d5cada50672a7a286bf5e4bbd3",
"components": {
"apache": {
"name": "Apache HTTP Server",
@@ -8574,6 +8578,24 @@ Claims (full source mapping in the JSON block below):
# nginx: TLS and authentication
+nginx is a web server, commonly run as a reverse proxy in front of applications. This guide helps your AI assistant make sure it is configured securely: an HTTPS server block with a certificate, HTTP redirected to HTTPS, authentication required, and expensive endpoints bounded.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/nginx.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against nginx source release-1.26.3, Certbot nginx configurator v2.3.0, Authelia nginx integration v4.39.28, oauth2-proxy nginx integration v7.15.4, Apache httpd source 2.4.69, Debian apache2 packaging 2.4.69-1, HSTS specification RFC 6797, and OWASP Password Storage Cheat Sheet commit 72865b1e; 3 further sources carry no recorded version. Metadata reviewed 2026-10-17; documentation checked September 2026. The guide records 28 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -8813,23 +8835,7 @@ ss -tlnp # read every listener; 3000: the app itself: 127.0.0.1 only, never 0.
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/nginx.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -8887,7 +8893,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-17",
"documentation_checked": "2026-09",
- "body_sha256": "07eda7c75b5cada2d56a730e2c7a33df34730eec5139f55d0545aad278723811",
+ "body_sha256": "c0b31e49861f861f02aaad2b3398a3b682ae2d41f53f71f641dbc189d6d6f780",
"components": {
"nginx-source": {
"name": "nginx source",
@@ -12203,6 +12209,24 @@ Claims (full source mapping in the JSON block below):
# Kubernetes: Gateway API TLS and authentication
+Kubernetes runs containerized applications across a cluster of machines. This guide helps your AI assistant configure cluster exposure securely, including a Gateway API entry point that terminates TLS with automatic certificates, authentication at that entry point, no casually public Services, and a protected control plane.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/kubernetes.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Kubernetes kubelet/kubeadm source v1.37.1, Envoy Gateway v1.9.1, cert-manager Gateway support minimum 1.15, and GKE new-cluster read-only-port boundary 1.32; 1 further source is pinned to a commit and 12 carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 50 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -12632,23 +12656,7 @@ allowed ranges out of the provider's own configuration rather than inferring the
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/kubernetes.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -12734,7 +12742,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "1e80b5ac6d9df2701bae1929db0d6cb2f9ce6416a58415b189d509640b8a44c8",
+ "body_sha256": "e0bf72ca6921b2109e2cccbf686f833f922dcd9408584d05d03aa9a43a5eafab",
"components": {
"kubelet": {
"name": "Kubernetes kubelet/kubeadm source",
@@ -12955,6 +12963,24 @@ Claims (full source mapping in the JSON block below):
# GitOps controllers: Argo CD and Flux
+Argo CD and Flux are GitOps tools: they watch a Git repository and keep a Kubernetes cluster matching it, using whatever permissions they are granted. This guide helps your AI assistant configure each securely, including guarded admin access, reviewed changes to the repositories they deploy, narrow credentials, and restricted egress.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/gitops-controllers.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Argo CD v3.5.3 source (pinned to a commit), Flux OIDC introduction v2.9, Dex source v2.45.1, Redis source 8.2.3, and curl curl-8_14_1; 1 further source is pinned to a commit and 3 carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 50 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -13423,23 +13449,7 @@ they were not rechecked online. Remaining source limits are identified above.
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/gitops-controllers.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -13517,7 +13527,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-19",
"documentation_checked": "2026-09",
- "body_sha256": "908b108054ff323b7d30f6ec6652728a0d065571804b124943b579b8f09f77cc",
+ "body_sha256": "290b24b86bba2e9137a85bd45010968f38ebe895865712fb799a2f15553b9f5a",
"components": {
"argo": {
"name": "Argo CD v3.5.3 source",
@@ -13717,6 +13727,24 @@ Claims (full source mapping in the JSON block below):
# Self-hosted CI runners: GitHub Actions and GitLab Runner
+GitHub Actions self-hosted runners and GitLab Runner run CI jobs on machines you manage. This guide helps your AI assistant configure runners securely, including limits on whose code can start jobs, untrusted jobs on isolated disposable workers apart from deployment runners, narrow credentials, and egress enforced outside the job.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/self-hosted-ci-runners.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against GitHub Actions documentation (no recorded version), GitHub REST API 2026-03-10, and Python tomllib minimum 3.11; 3 further sources carry no recorded version. Metadata reviewed 2026-10-12; documentation checked September 2026. The guide records 37 claims: 1 demonstrated by a check that ran and 36 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -13996,23 +14024,7 @@ Version boundary: GitHub.com documentation checked 18 September 2026, with REST
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/self-hosted-ci-runners.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -14074,7 +14086,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-12",
"documentation_checked": "2026-09",
- "body_sha256": "72e6c5e6e8aa98cd95989f98eb383a327daaecd20809fcb2d24aea181dee4f4e",
+ "body_sha256": "b6f0a62c993bb4e0b4f09ddd47a88c26c7f4aa976af303c778de05d1c17f8fd4",
"components": {
"github": {
"name": "GitHub Actions documentation",
@@ -20919,6 +20931,24 @@ Claims (full source mapping in the JSON block below):
# PostgreSQL: TLS and authentication
+PostgreSQL is a relational database that stores application data in tables queried with SQL. This guide helps your AI assistant make sure it is configured securely, including a private listener, TLS and SCRAM passwords for remote connections, an application role that does not own its tables, and connection logging.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/postgresql.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against PostgreSQL initdb source REL_17_11, PostgreSQL TLS minimum 12, PostgreSQL SCRAM default 14, PostgreSQL schema defaults 15, PostgreSQL membership and require_auth 16, and PostgreSQL MD5 and logging changes 18; 2 further sources are pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 46 claims: 2 demonstrated by a check that ran and 44 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -21574,23 +21604,7 @@ WHERE error IS NOT NULL OR NOT applied;
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/postgresql.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -21664,7 +21678,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "c0a10a106c69c2bc4358843a0ba962adc1a8fbc25b152175d1d7154d69aa07a4",
+ "body_sha256": "1e7cc90c02705b8569bcedf37bbc020a095a0961a6e3b2d9785c422427ee9621",
"components": {
"init": {
"name": "PostgreSQL initdb source",
@@ -22460,6 +22474,24 @@ Claims (full source mapping in the JSON block below):
# MySQL and MariaDB: TLS and authentication
+MySQL and MariaDB are relational databases that applications use to store their data. This guide helps your AI assistant make sure a server is configured securely: a private bind address, TLS required, scoped accounts with anonymous access removed, password validation enabled, file loading restricted, and clients connecting with verification.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/mysql.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against MySQL reference 8.4, 8.0, 9.7, and 26.7, MySQL Docker package mysql-8.4.9, and MariaDB package source mariadb-11.8.9; 2 further sources are pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 55 claims: 2 demonstrated by a check that ran and 53 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -23210,23 +23242,7 @@ Verification scope:
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/mysql.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -23309,7 +23325,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "3b7ba3deadbbecb403f8d7f1dd08cd323d71dcadc157fea97a6df766c8b1eb28",
+ "body_sha256": "eec3f21a667a9ef2e9a156f96742464a6eb8be7c86c5abe946a9b4976f0d0ba9",
"components": {
"mysql": {
"name": "MySQL reference",
@@ -23523,6 +23539,24 @@ Claims (full source mapping in the JSON block below):
# MongoDB: TLS and authorization
+MongoDB is a database that stores records as flexible, JSON-like documents. This guide helps your AI assistant configure it securely, including authorization with collection-scoped application roles, a private bind, TLS for clients and cluster members, and, on MongoDB Enterprise only, auditing, diagnostic-log redaction and native storage encryption.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/mongodb.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against MongoDB bind source r8.0.32 and MongoDB documentation 8.0; 1 further source is pinned to a commit and 3 carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 81 claims: 1 demonstrated by a check that ran and 80 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -24257,23 +24291,7 @@ QE requires a new encrypted collection created with an `encryptedFields` definit
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/mongodb.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -24379,7 +24397,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "8b2445dc1e8749610ca70401436e9371ff8e3717fc36d5980a8f76e7520e47ae",
+ "body_sha256": "e82821dd0bc0e04677bf7d322ad9fa99618a81e033ff19d110a241e939490ba9",
"components": {
"bind": {
"name": "MongoDB bind source",
@@ -24575,6 +24593,24 @@ Claims (full source mapping in the JSON block below):
# Redis: TLS and authentication
+Redis is an in-memory data store used as a cache, key-value database or message channel. This guide helps your AI assistant configure it securely, including a local bind unless remote access is deliberate, a required credential, locked-down runtime commands, and TLS where server and client are built with it.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/redis.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Redis configuration 6.0.20, 6.2.14, 6.2.0, 7.0.15, 8.2.1, and 8.6.0, Redis HA source 8.10.1, Redis image tag v8.10.2, and Redis compiled defaults 7.4.8 and 8.10.2; 1 further source is pinned to a commit and 3 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 59 claims: 1 demonstrated by a check that ran and 58 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -25402,23 +25438,7 @@ The tagged configuration files below pin syntax and historical behaviour; they a
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/redis.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -25510,7 +25530,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "bdd2c88e86e24637097c57f8abfd523f83b1044fefe1d7d33aaddd94532315e6",
+ "body_sha256": "58a7f8f6163790b93cb5733b18b3bc572500b09eb588bdf38b61363840f1ded4",
"components": {
"r60": {
"name": "Redis configuration",
@@ -25742,6 +25762,24 @@ Claims (full source mapping in the JSON block below):
# Elasticsearch and OpenSearch: keep security switched on
+Elasticsearch and OpenSearch are search engines that index documents and logs for searching. This guide helps your AI assistant keep their security switched on, including TLS and authentication, scoped roles, anonymous access off, CORS off unless a browser needs it, and audit logging on OpenSearch or paid Elasticsearch tiers.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/elasticsearch.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Elasticsearch API 8.x, Elasticsearch reference 8.19, Elasticsearch listener source 8.19.22 and 9.5.4, OpenSearch reference 3.6, OpenSearch S3 reference 3.1, OpenSearch S3 source 3.8.0, OpenSearch GCS source 3.8.0, and OpenSearch Azure source 3.8.0, plus 5 more recorded bases; 3 further sources are pinned to a commit and 4 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 65 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -26754,23 +26792,7 @@ REASONED: deployment expectations and source-audit limits recorded in this guide
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/elasticsearch.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -26876,7 +26898,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "b7be20e1e922213f3221d68ed2688b87163c51f827766052d8f533076a1938ab",
+ "body_sha256": "28bc44a107ca57a92533925c4be8dce48e1af9a9ab4a126737a9a91b7fbcd15d",
"components": {
"es-api": {
"name": "Elasticsearch API",
@@ -27220,6 +27242,24 @@ Claims (full source mapping in the JSON block below):
# MinIO: credentials, TLS, encryption, and object protection
+MinIO (now shipped as AIStor) is object storage you run yourself: apps store files in buckets through the same API as Amazon S3. This guide helps your AI assistant configure it securely, including real root credentials, TLS, scoped application access, and encryption with a key manager.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/minio.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against AIStor documentation (no recorded version); 1 further source is pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 44 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -27772,23 +27812,7 @@ REASONED from the cited AIStor documentation: OIDC role-policy and claim-policy
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/minio.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -27854,7 +27878,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "8532b3aa69cdb790096c6fbe1ce337c046f59245c4122418832204ca3101ee94",
+ "body_sha256": "c6513da7841b2b2ceb5833dbb8b05c527d688d65babf3332b616f77ce92bedcb",
"components": {
"aistor": {
"name": "AIStor documentation",
@@ -27979,6 +28003,24 @@ Claims (full source mapping in the JSON block below):
# RabbitMQ: users, TLS listener, and the guest account
+RabbitMQ is a message broker: applications drop messages into its queues, and it delivers them to programs that process them. This guide helps your AI assistant configure it securely, including real users instead of the default guest account, a TLS listener, a protected management UI, and restricted Erlang distribution ports.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/rabbitmq.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against RabbitMQ source v4.3.6, rabbitmqadmin v2, RabbitMQ topic authorization introduction 3.7.0, and Erlang/OTP distribution 27; 2 further sources are pinned to a commit and 3 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 35 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -28625,23 +28667,7 @@ The write pattern gates publishing and the read pattern gates the routing keys a
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/rabbitmq.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -28704,7 +28730,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "02208e1c7164f30bd94a7488df842c3d2b5709113cd61925722fae35b7159460",
+ "body_sha256": "ef36f39217b1d41b9b928bce531c4cb6f6cbd1edc4978eecf39ba217dc47196c",
"components": {
"source": {
"name": "RabbitMQ source",
@@ -28850,6 +28876,24 @@ Claims (full source mapping in the JSON block below):
# Mosquitto (MQTT): no anonymous clients, TLS listener
+Mosquitto is an MQTT broker: devices and programs publish short messages to named topics, and it passes them to whoever has subscribed. This guide helps your AI assistant make sure it is configured securely, including credentials for each device, no anonymous clients, a TLS listener, and access checked per topic.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/mosquitto.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Mosquitto v2.0.22 and v2.1.2 and Mosquitto legacy v1.6.15; 2 further sources are pinned to a commit and 2 carry no recorded version. Metadata reviewed 2026-10-05; documentation checked October 2026. The guide records 45 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -29356,23 +29400,7 @@ The explicit `$SYS/#` subscription should receive broker telemetry in the expose
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/mosquitto.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -29443,7 +29471,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-05",
"documentation_checked": "2026-10",
- "body_sha256": "73b1d3529e9fdfcd23efa56ade3bf305d2e5d39c8844da14cbcb843de2ef6dc9",
+ "body_sha256": "f4230abfb1a0cff6279347972a67fd1b425fe2baa8fb4ddb8b0f96c017d87f7b",
"components": {
"v20": {
"name": "Mosquitto",
@@ -29598,6 +29626,24 @@ Claims (full source mapping in the JSON block below):
# Apache Kafka: SASL_SSL listeners, SCRAM credentials, and ACLs
+Apache Kafka is a message broker: applications write records to named topics and other applications read them. This guide helps your AI assistant make sure it is configured securely, including the plaintext listener replaced, TLS on the broker, SASL/SCRAM credentials, ACL authorization, bounded connection pressure, and authorization decisions logged.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/kafka.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Kafka listener default 4.3.1, Kafka documentation 4.3, Kafka source 4.3.0, Kafka legacy authorization 3.9, and OpenSSL documentation 3.5; 2 further sources carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 41 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -30472,23 +30518,7 @@ The checks below remain REASONED from the cited Kafka documentation and pinned s
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/kafka.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -30555,7 +30585,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "c80f1359a5fb3b112acf8d1cfebf794410c4a50e67811d9dd689202f9bf7ad24",
+ "body_sha256": "a8895638cceb0f2c665a90eea1ac7461741b44c86c0250bd384749a4f3a3e67e",
"components": {
"default": {
"name": "Kafka listener default",
@@ -30690,6 +30720,24 @@ Claims (full source mapping in the JSON block below):
# ClickHouse: listen address, the default user, and TLS ports
+ClickHouse is a database server built for analytical queries over very large tables. This guide helps your AI assistant configure it securely, including a narrow listen address, a password on the default user with real accounts beside it, query limits and quotas, and TLS ports with plaintext ports off.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/clickhouse.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against ClickHouse documentation (no recorded version); 5 further sources are pinned to a commit and 2 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 53 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -31377,23 +31425,7 @@ SHOW CREATE TABLE system.session_log;
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/clickhouse.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -31473,7 +31505,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "67374bff4359a86dc344995e032dda6915d16c577426b9a057ca0bf54b0de417",
+ "body_sha256": "14afbfa6b0f58e11e9255aff2b25d80a98cf91b747e75e1d0f4f8bb56ea50474",
"components": {
"docs": {
"name": "ClickHouse documentation",
@@ -32748,6 +32780,24 @@ Claims (full source mapping in the JSON block below):
# Memcached: bind privately; authentication and TLS are optional builds
+Memcached is a cache that keeps data in memory so applications can read it quickly. This guide helps your AI assistant configure it securely, including a loopback or private bind with UDP off, an unprivileged account, and TLS and binary-protocol SASL login only on builds and clients that support them.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/memcached.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against memcached source 1.6.45 and OpenSSL CLI 3.0; 3 further sources are pinned to a commit and 4 carry no recorded version. Metadata reviewed 2026-10-15; documentation checked September 2026. The guide records 37 claims: 1 demonstrated by a check that ran and 36 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -33109,23 +33159,7 @@ For a binary SASL deployment, also repeat SET, GET, FLUSH, and GET through the a
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/memcached.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -33190,7 +33224,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-15",
"documentation_checked": "2026-09",
- "body_sha256": "77879497a23f39f20a85c1fcdb98885f433f831eaa2ed19d973079a8799d182c",
+ "body_sha256": "82b8cf0ecf7a91a0e02496521796e1f456a7443f80ac6ff38b21aa81abbf1274",
"components": {
"stable": {
"name": "memcached source",
@@ -33317,6 +33351,24 @@ Claims (full source mapping in the JSON block below):
# Object storage: S3, Cloudflare R2, Google Cloud Storage, Azure Blob, Supabase Storage
+Amazon S3, Cloudflare R2, Google Cloud Storage, Azure Blob Storage and Supabase Storage store files in buckets or, on Azure, containers. This guide helps your AI assistant configure them securely, including public access blocked for private data, per-application permissions, HTTPS enforced where supported, and short-lived signed links for sharing.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/object-storage.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Amazon S3 documentation (no recorded version); 4 further sources carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 63 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -33995,23 +34047,7 @@ REASONED: Historical evidence boundary; no original authoring receipts, authoriz
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/object-storage.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -34098,7 +34134,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "144f53a7276f2cc8a871e086cc84b0723735f429acf6d679ec60065aeaef8531",
+ "body_sha256": "7041f0cbd34c03fc6d672bcec4627cf01e04ff0a9d5c2ab383a7dd43639eb9fd",
"components": {
"s3": {
"name": "Amazon S3 documentation",
@@ -34281,6 +34317,24 @@ Claims (full source mapping in the JSON block below):
# NATS and JetStream: authentication, TLS, and the monitoring port
+NATS is a messaging server that passes messages between applications by subject name, and JetStream is its built-in feature for storing those messages. This guide helps your AI assistant configure a deployment securely, including required client authentication, scoped subjects, TLS, a private monitoring port, and bounded JetStream storage.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/nats.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against NATS Server v2.14.7, NATS image listener source v2.15.0, natscli v0.4.0, and Go socket source go1.26.8; 3 further sources are pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 65 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -35461,23 +35515,7 @@ REASONED: scope of the original authoring record and its shell-only evidence. Th
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/nats.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -35569,7 +35607,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "f0ed2c277c31a17bf1ab9675093049dc936f11fc2d2a8c07925c9c6fbd95d872",
+ "body_sha256": "44f2e28b39cf562f5e552741eb87c2e6c26ee81230a3540a09da3aeb481dcdaa",
"components": {
"server": {
"name": "NATS Server",
@@ -35769,6 +35807,24 @@ Claims (full source mapping in the JSON block below):
# Search engines for RAG: Meilisearch and Typesense
+Meilisearch and Typesense are search engines that index your documents and answer search queries over HTTP. This guide helps your AI assistant configure each securely, including a master or bootstrap key that stays on the server, scoped keys for search clients, private listeners, and TLS from a fronting proxy.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/search-engines.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Meilisearch release reference v1.53.2, Typesense 30.2, Caddy v2.11.4, curl minimum 7.75.0, Git grep manual 2.55.0, Git rev-list manual 2.56.0, and Git manual 2.56.0; 4 further sources carry no recorded version. Metadata reviewed 2026-10-12; documentation checked October 2026. The guide records 30 claims: 10 demonstrated by a check that ran and 20 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -36021,23 +36077,7 @@ Version scope: Typesense 30.2; Meilisearch current unversioned documentation che
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/search-engines.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -36097,7 +36137,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-12",
"documentation_checked": "2026-10",
- "body_sha256": "98bf2bbbb774a4c7e71ec7f07b9035b6127771baa4c953d0b35d251f59f0b34c",
+ "body_sha256": "73a2ed139255dbf7d9b8fd1266d7f4be08bf7ef645f16c82af65a4a7ac8cb536",
"components": {
"meili": {
"name": "Meilisearch release reference",
@@ -37891,6 +37931,24 @@ Claims (full source mapping in the JSON block below):
# Time-series and metrics stores: InfluxDB, VictoriaMetrics, and QuestDB
+InfluxDB, VictoriaMetrics and QuestDB are time-series databases: they store readings over time, like server metrics. This guide helps your AI assistant configure each securely, including InfluxDB 2.x setup finished privately and applications given scoped tokens, VictoriaMetrics cluster RPC ports limited to cluster members, and QuestDB's default database login changed.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/time-series-metrics-stores.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against InfluxDB OSS 2.x and 1.x, VictoriaMetrics single-node v1.152.0, VictoriaMetrics cluster v1.152.0-cluster, VictoriaMetrics shipped Compose image v1.151.0, and QuestDB Enterprise qualification 4.0.0; 2 further sources are pinned to a commit and 2 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 45 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -38105,23 +38163,7 @@ REASONED: the VictoriaMetrics v1.152.0 single-node endpoint-key and Basic-auth c
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/time-series-metrics-stores.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -38195,7 +38237,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "e0da00137fe67ffece497c6157594e02a012c12e44d704253e4499707b36dc02",
+ "body_sha256": "c23bb50631d831bd18048dc9ccf27e744b89cd79d044c0023ea923a2ce381c72",
"components": {
"influx2": {
"name": "InfluxDB OSS",
@@ -38368,6 +38410,24 @@ Claims (full source mapping in the JSON block below):
# Jupyter: password and TLS
+Jupyter lets people write and run code in browser-based notebooks, and JupyterHub hosts notebook servers for many users. This guide helps your AI assistant configure a deployment securely, including passwords on standalone servers, TLS, origin and Host checks kept on, and separate identities and system accounts for Hub users.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/jupyter.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Jupyter Server 2.18.0, JupyterHub 5.5.2, jupyter_client 8.6.3, configurable-http-proxy 5.3.0, and NativeAuthenticator 1.3.0; 5 further sources are pinned to a commit and 6 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 63 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -38916,23 +38976,7 @@ Keep `open_signup` at its default `False`: with it off, a pending account waits
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/jupyter.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -39030,7 +39074,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "1bdfe2f4964c65f610a2748bb78167f6ccd9ceac240202250ca83181182816d5",
+ "body_sha256": "359a3aa584b686b71c6f4a858e8228a0deee908b40749114eee24808357e965e",
"components": {
"server": {
"name": "Jupyter Server",
@@ -39239,6 +39283,24 @@ Claims (full source mapping in the JSON block below):
# Ollama: it has no built-in authentication or TLS
+Ollama runs AI language models on your own machine and serves them to other apps through a local web API. This guide helps your AI assistant configure it securely, including a private listener, login, TLS and MFA at a fronting layer, model management limited to administrators, and bounded inference load.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/ollama.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Ollama v0.34.2, Docker Engine localhost boundary 28.0, and systemd v257; 1 further source is pinned to a commit and 7 carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 65 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -40090,23 +40152,7 @@ These commands validate configuration acceptance; they do not prove authenticati
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/ollama.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -40201,7 +40247,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "9ab3957a42bab62de0ca660b5a70d60cd251fdd1dd5885385764804259ab0fe8",
+ "body_sha256": "34ac518ca7b67386e0d088de717b4115b6f49aa94df5755a7d8a0d907c4e97f4",
"components": {
"ollama": {
"name": "Ollama",
@@ -40402,6 +40448,24 @@ Claims (full source mapping in the JSON block below):
# Open WebUI: signup control, TLS, and MFA
+Open WebUI is a chat website you host yourself for talking to local or cloud-hosted language models. This guide helps your AI assistant configure it securely, including controlled registration, a private bind with TLS in front, authentication kept on, and restricted tools and code execution.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/open-webui.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Open WebUI (pinned to a commit) and Docker Engine localhost boundary 28.0.0; 1 further source carries no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 62 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -40784,23 +40848,7 @@ The native password-signin limiter is **15 attempts per 180 seconds per email ad
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/open-webui.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -40884,7 +40932,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "f0a5c38cca708ba4474566b366f8c9a89f4e265ed20e89cffdd87ccabe0713ab",
+ "body_sha256": "e6eb00e72d10a128963f4af6aa7f35a6edee3713ec80a492e09533e0c5395238",
"components": {
"webui": {
"name": "Open WebUI",
@@ -41004,6 +41052,24 @@ Claims (full source mapping in the JSON block below):
# LiteLLM proxy: master key and virtual keys
+LiteLLM's proxy lets your apps reach many AI model providers through one address, using paid keys it holds. This guide helps your AI assistant configure it securely, including a protected master key, per-application virtual keys with spending limits, a private bind behind TLS, and request content kept out of logs.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/litellm.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against LiteLLM SSO allowance v1.76.0, LiteLLM metrics default v1.85.0, and LiteLLM CLI v1.102.1; 1 further source is pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 51 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -41451,23 +41517,7 @@ The checks below remain REASONED from the cited LiteLLM documentation and pinned
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/litellm.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -41542,7 +41592,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "2a5e3014404a2d45329664d113112b9a482ab9426c3c2c0da18d404541b2b3e6",
+ "body_sha256": "742a27a1d48e5c278e6d8f71c2ce3efc2e99f67fe027cd858e79a0b7bf0c623f",
"components": {
"sso": {
"name": "LiteLLM SSO allowance",
@@ -41669,6 +41719,24 @@ Claims (full source mapping in the JSON block below):
# Model servers: llama.cpp, vLLM, TGI, SGLang, Triton, and LM Studio
+llama.cpp, vLLM, TGI, SGLang, Triton, LM Studio and text-generation-webui run AI models and answer prompts over a network API. This guide helps your AI assistant configure each securely, including a private bind, a per-client API key checked natively or by a proxy, TLS in front, and public share flags off.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/model-servers.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against llama.cpp (pinned to a commit), vLLM v0.30.0, TGI launcher/image v3.3.7, SGLang v0.5.20, and curl minimum write-out version 7.75.0; 7 further sources are pinned to a commit and 4 carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 75 claims: 3 demonstrated by a check that ran and 72 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -42197,23 +42265,7 @@ For cross-node endpoints in an intentionally exposed test deployment, the outsid
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/model-servers.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -42323,7 +42375,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "dc7078b0adb279c69f166862daf75d2ed7df8154841ffe119517de720fc237c0",
+ "body_sha256": "c5995504794d271a3afa17c309984d06bf3b3843baead15d43b4ee3d935d0ddb",
"components": {
"llama": {
"name": "llama.cpp",
@@ -42647,6 +42699,24 @@ Claims (full source mapping in the JSON block below):
# Gradio: launch() authentication and TLS
+Gradio is a Python framework that serves an interactive web app from a script's launch() call. This guide helps your AI assistant make sure an app is configured securely: a login required, TLS in place, public sharing avoided, file access and uploads restricted, and queued work and URL fetching bounded.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/gradio.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Gradio 6.28.0 and Gradio historical fixes 6.16.0 and 6.20.0; 2 further sources carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 53 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -42975,23 +43045,7 @@ ss -tlnp # With server_port=None, the port search starts at 7860 unless GRADIO
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/gradio.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -43068,7 +43122,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "b05b85a4144bcb16a146ea0834470b7f5b89ae7edc2bd28e0de73d88d5cc0eb4",
+ "body_sha256": "c44959d1827e9747ad6155b6d85ce94ee5a79954570c23c478db0531c82a0ec1",
"components": {
"gradio": {
"name": "Gradio",
@@ -43182,6 +43236,24 @@ Claims (full source mapping in the JSON block below):
# Streamlit: TLS and authentication
+Streamlit is a Python library that turns data scripts into interactive web apps. This guide helps your AI assistant configure an app securely, including a loopback bind with TLS from a proxy or tunnel, a native OIDC login or an authenticating proxy, and reviewed uploads, static files and outbound traffic.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/streamlit.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Streamlit 1.64.0, Google OpenID Connect documentation rolling documentation, checked 2026-10-15, Authlib minimum 1.3.2, httpx minimum 0.24.1, Caddy v2.11.4, oauth2-proxy v7.15.4, Keycloak 26.7.4, and curl minimum write-out version 7.75.0; 3 further sources carry no recorded version. Metadata reviewed 2026-10-05; documentation checked October 2026. The guide records 35 claims: 12 demonstrated by a check that ran and 23 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -43397,23 +43469,7 @@ Source-checked on 2026-09-18 against Streamlit 1.64.0, the current release at th
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/streamlit.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -43478,7 +43534,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-05",
"documentation_checked": "2026-10",
- "body_sha256": "8f1af50b58ec9e65f321989751e1ee7d32e9d068e8bbd945a9fe571806ce9449",
+ "body_sha256": "c83bdc30997ec7651c814a21832622c8369ec43b9752c05c4a1130ac0e5a9f10",
"components": {
"streamlit": {
"name": "Streamlit",
@@ -43625,6 +43681,24 @@ Claims (full source mapping in the JSON block below):
# n8n: binding, TLS, and MFA
+n8n is a workflow automation tool with a web editor and webhook endpoints. This guide helps your AI assistant make sure it is configured securely: a private bind, TLS from a proxy or n8n itself, accounts with MFA, webhook authentication, and code-node execution isolated.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/n8n.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against n8n listener source n8n@2.40.6, n8n runtime source n8n@2.40.6, n8n environment policy minimum 2.18.0, n8n SSRF filter minimum 2.12.0, n8n 2.0 default exclusion source n8n@2.0.0, and n8n 1.x default exclusion source n8n@1.123.85; 2 further sources carry no recorded version. Metadata reviewed 2026-10-17; documentation checked October 2026. The guide records 29 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -43755,23 +43829,7 @@ curl -q -g -sS --noproxy '*' --connect-timeout 5 --max-time 10 -o /dev/null \
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/n8n.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -43827,7 +43885,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-17",
"documentation_checked": "2026-10",
- "body_sha256": "e6ab2c6368d6789dbe755e757ab49c02987858a1dd7f6f53731b64637310e0cc",
+ "body_sha256": "b2a8d012fa5a0129e243d83f2e6d5421340f05ecb83225898b1bb9b2e9132961",
"components": {
"server": {
"name": "n8n listener source",
@@ -43949,6 +44007,24 @@ Claims (full source mapping in the JSON block below):
# code-server: browser VS Code without giving away the machine
+code-server runs VS Code on a server for use in a browser, and its terminal runs commands on that server. This guide helps your AI assistant configure it securely, including SSH forwarding first, a tailnet or MFA-protected tunnel next, and otherwise a loopback bind behind a TLS proxy adding MFA.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/code-server.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against code-server v4.137.0. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 18 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -44067,23 +44143,7 @@ REASONED: preceding block; listener inventory, direct-origin isolation, paired e
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/code-server.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -44121,7 +44181,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "4dfd35a63a16c1e36dc1b89dd972dd12f78009c6ba4876f4a2ef920a7f18bfbe",
+ "body_sha256": "6af52661ed92dd7e53af1386f2ab7b4fc21d17234fed1678687fac88fbef6a48",
"components": {
"server": {
"name": "code-server",
@@ -44166,6 +44226,24 @@ Claims (full source mapping in the JSON block below):
# Self-hosted error trackers: Sentry and GlitchTip
+Sentry and GlitchTip are error trackers: apps send them crash reports with stack traces and request details. This guide helps your AI assistant configure an instance securely, including a loopback bind behind a TLS proxy, open sign-up off (GlitchTip ships it on), required MFA, and unpublished backing stores.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/self-hosted-error-trackers.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Sentry and self-hosted distribution 26.8.0 and GlitchTip backend v6.2.6; 3 further sources carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 23 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -44296,23 +44374,7 @@ Point that block at Sentry's `http://tracker.example.com:9000/`: because the bun
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/self-hosted-error-trackers.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -44359,7 +44421,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "a1352e0b28964f85a1f3a0de1c89e5e95afe80e0a6386c794e57ee88b70a1138",
+ "body_sha256": "3352bcdbc8350cf1e4966038e3e9531acf00baa3cf839fd59dff973a9bb555e9",
"components": {
"sentry": {
"name": "Sentry and self-hosted distribution",
@@ -44440,6 +44502,24 @@ Claims (full source mapping in the JSON block below):
# Vector databases: Qdrant, Weaviate, Milvus, Chroma, pgvector
+Qdrant, Weaviate, Milvus and Chroma are vector databases that find text by meaning; pgvector adds this to PostgreSQL. This guide helps your AI assistant configure each securely, including Weaviate's anonymous access off, Milvus's default root password changed, and Chroma behind an authenticated TLS proxy, Cloudflare Tunnel with Access or tailnet.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/vector-databases.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Qdrant source v1.19.1, Weaviate source v1.39.6, Milvus v2.6.24 and v3.0.2, Milvus Helm chart 5.0.30, Milvus Operator v1.3.11, Chroma source 1.5.9, Chroma migration documentation v1.0.0, and pgvector source v0.8.2, plus 5 more recorded bases; 8 further sources carry no recorded version. Metadata reviewed 2026-10-15; documentation checked September 2026. The guide records 55 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -44718,23 +44798,7 @@ REASONED: tenant isolation and bypass positive control. A live PostgreSQL with p
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/vector-databases.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -44831,7 +44895,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-15",
"documentation_checked": "2026-09",
- "body_sha256": "83c865153d5158fab30da3bb303117817f1cd6c1b1471dc48e0fbac05ec35363",
+ "body_sha256": "fc2918727d64bf41798db38364a7e8b86163fc4fb056a85b4a6cb21e3f26663b",
"components": {
"q": {
"name": "Qdrant source",
@@ -45234,6 +45298,24 @@ Claims (full source mapping in the JSON block below):
# MCP servers: exposing Model Context Protocol servers safely
+MCP (Model Context Protocol) lets AI apps call outside tools; an MCP server provides them, locally or over the web. This guide helps your AI assistant expose one securely, including stdio for single-user workstation tools, narrow credentials, and for HTTP servers a loopback bind, Origin checks, TLS and authentication.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/mcp-servers.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against MCP 2026-07-28, MCP legacy 2025-11-25, and curl minimum 7.75.0; 3 further sources carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 39 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -45507,23 +45589,7 @@ REASONED: following block; the wrong-audience probe in the following block, per
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/mcp-servers.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -45587,7 +45653,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "0bcd9d4fb2535bc980fd10f761968917dba5b42d4021b7142a3d1f071c184738",
+ "body_sha256": "107daa3cbc37b9666249b278fb96792e7ba3ed712bbb07018b6393d15a17f36a",
"components": {
"mcp": {
"name": "MCP",
@@ -45697,6 +45763,24 @@ Claims (full source mapping in the JSON block below):
# MCP clients: authorizing to Model Context Protocol servers safely
+An MCP client is the program, such as a desktop app or CLI, that talks to Model Context Protocol servers. This guide helps your AI assistant secure OAuth sign-in to remote servers, including the response issuer checked when present and required when advertised, confidential refresh tokens, and SSRF-safe discovery requests.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/mcp-clients.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against MCP 2026-07-28, OAuth 2.1 draft draft-ietf-oauth-v2-1-14, CIMD draft draft-ietf-oauth-client-id-metadata-document-00, and OpenID Connect 1.0 errata 2; 2 further sources are pinned to a commit and 2 carry no recorded version. Metadata reviewed 2026-10-17; documentation checked September 2026. The guide records 29 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -45861,23 +45945,7 @@ These checks are client-behaviour checks. Standing up a full malicious-authoriza
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/mcp-clients.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -45933,7 +46001,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-17",
"documentation_checked": "2026-09",
- "body_sha256": "7e61d3251d272d600eb84579980483338e378661f71af77fa39229aab130eb78",
+ "body_sha256": "507ddfd13be682862609aae600e35aaf5ff3875fda558e553f85ad1a5611a481",
"components": {
"mcp": {
"name": "MCP",
@@ -46045,6 +46113,24 @@ Claims (full source mapping in the JSON block below):
# Ray: dashboard, Jobs, and Client ports execute code
+Ray is a framework for spreading Python work across machines. This guide helps your AI assistant configure a cluster securely, including dashboard access over SSH, a tailnet or an authenticating TLS proxy, network isolation as the main boundary, and token authentication on Ray 2.52.0 and later as extra protection.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/ray.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Ray pinned source ray-2.58.0, Ray token authentication introduction 2.52.0, KubeRay chart v1.7.0, KubeRay authentication source v1.6.0, KubeRay prior RayCluster types v1.5.0, CPython WSGI server v3.11.0, and curl minimum write-out version 7.75.0; 1 further source is pinned to a commit and 5 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 46 claims: 1 demonstrated by a check that ran and 45 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -46349,23 +46435,7 @@ REASONED: mixed historical listener observations and unrun service comparisons f
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/ray.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -46443,7 +46513,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "286cb3508e87ad0658bd57c73270ab3b4100681250bae339f4d71a573e537bfb",
+ "body_sha256": "ecf05a76c43042bce13d9c3d1551edf5b8e4887d5ce398c53fb1a8a3eb7ac9f3",
"components": {
"ray": {
"name": "Ray pinned source",
@@ -47103,6 +47173,24 @@ Claims (full source mapping in the JSON block below):
# Agent and workflow builders: Dify, Flowise, Langflow, LibreChat
+Dify, Flowise, Langflow and LibreChat are tools for building AI chatbots, agents and workflows whose flows can run code and call other services. This guide helps your AI assistant configure each securely, including private binds behind TLS, default secrets replaced, MFA from OIDC or a fronting proxy, and contained flows.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/agent-builders.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Dify plugin daemon 0.6.10, Flowise account minimum v3.0.1, Langflow settings source v1.12.6, LibreChat changelog v0.7.7, Docker Compose go.mod v2.24.3, Docker Compose release source v2.24.4, compose-go loader v2.0.0-rc.2, and compose-go reset loader v2.0.0-rc.3; 8 further sources are pinned to a commit and 5 carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 58 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -47387,23 +47475,7 @@ curl -q -g -sS -L --proto-redir '=https' --noproxy '*' --connect-timeout 5 --max
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/agent-builders.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -47501,7 +47573,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-19",
"documentation_checked": "2026-09",
- "body_sha256": "d9b3ee77e381107c6cb13fbb56ef6cc80dad8ebcffdf662fb0c82608db2cd8f2",
+ "body_sha256": "0d9ea78e5c061542cfce533e70348b663d5fd6fd199aab9cbbff6a99b0b5cefa",
"components": {
"daemon": {
"name": "Dify plugin daemon",
@@ -47794,6 +47866,24 @@ Claims (full source mapping in the JSON block below):
# AI infrastructure services: SearxNG, LocalAI, Text Embeddings Inference, LangServe, Mem0, and Onyx
+SearxNG, LocalAI, Text Embeddings Inference, LangServe, Mem0 and Onyx are building blocks for AI apps, from web search to agent memory. This guide helps your AI assistant configure each securely, including authenticated TLS ingress, built-in login or keys enabled where available, and unpublished backing services, apart from deliberate loopback access.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/ai-infra-services.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against SearxNG documentation (no recorded version), TEI HTTP source v1.9.0, Onyx v4.3 source v4.3.13, Onyx v4.4 source v4.4.0, and GNU grep 3.12; 6 further sources are pinned to a commit and 6 carry no recorded version. Metadata reviewed 2026-10-15; documentation checked September 2026. The guide records 47 claims: 1 demonstrated by a check that ran and 46 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -48288,23 +48378,7 @@ The service facts come from the maintainer's vendor-source verification record d
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/ai-infra-services.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -48387,7 +48461,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-15",
"documentation_checked": "2026-09",
- "body_sha256": "b9931192e8250b1cb318e09284506c74670be8caecc620df4a16d60b15d8d9a0",
+ "body_sha256": "60945815f4a2fd5042b73043af96642c80d50eb23fc37dd84c49f1bf0656d6fe",
"components": {
"searx": {
"name": "SearxNG documentation",
@@ -48586,6 +48660,24 @@ Claims (full source mapping in the JSON block below):
# Realtime voice and video infrastructure: LiveKit and coturn
+LiveKit and coturn are media servers for live calls: LiveKit routes media between participants, and coturn relays media when devices cannot connect directly. This guide helps your AI assistant configure both securely, including strong LiveKit signing secrets, no development mode, TLS for signaling, and authenticated coturn with restricted relay destinations.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/realtime-voice-infra.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against LiveKit v1.13.7, livekit-cli v2.18.2, coturn 4.18.0, coturn DTLS opt-in introduction 4.17.0, curl minimum write-out version 7.75.0, OpenSSL CLI 3.0, and OpenSSL dgst 3.5; 1 further source is pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-10-12; documentation checked September 2026. The guide records 50 claims: 1 demonstrated by a check that ran and 49 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -48918,23 +49010,7 @@ REASONED: preceding block; what a deployment run of the s_client command does no
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/realtime-voice-infra.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -49012,7 +49088,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-12",
"documentation_checked": "2026-09",
- "body_sha256": "6bb6465c85da42813ed04f5b54eca18e250842363c68a5e60b4bb5ca0a9e72fc",
+ "body_sha256": "df59b1ac737e19a27ff0902375ec1de5745e752c20b83783e18c0fb8a172d023",
"components": {
"livekit": {
"name": "LiveKit",
@@ -49183,6 +49259,24 @@ Claims (full source mapping in the JSON block below):
# Image-generation UIs: ComfyUI, Stable Diffusion WebUI, InvokeAI, Fooocus
+ComfyUI, Stable Diffusion WebUI, InvokeAI and Fooocus are self-hosted browser apps for creating images with AI models. This guide helps your AI assistant configure each securely, including ports reachable only on host loopback, a tunnel or authenticated TLS proxy in front, Gradio share links off, and hardened containers where used.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/image-gen-uis.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against ComfyUI v0.37.0, AUTOMATIC1111 v1.10.1, Fooocus v2.5.5, Gradio 3.41.2, Docker Engine minimum loopback boundary 28.0, Docker Compose source v2.32.4, and curl minimum write-out version 7.75.0; 1 further source is pinned to a commit and 6 carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 28 claims: 2 demonstrated by a check that ran and 26 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -49442,23 +49536,7 @@ curl -q -g -sI https://imagegen.example.com/ # via the proxy: TLS
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/image-gen-uis.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -49519,7 +49597,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "49ea970f55cd616853fcf1e52aa83de8e57fb6b76cccb2b4b8664d7aecc8b0b7",
+ "body_sha256": "323781d5e470aa1f99186ca77372574fa7a5f6d63cef3a6e3b2293610775c817",
"components": {
"comfy": {
"name": "ComfyUI",
@@ -49704,6 +49782,24 @@ Claims (full source mapping in the JSON block below):
# Self-hosted chat and agent UIs: AnythingLLM, LobeChat, Chainlit, OpenHands
+AnythingLLM, LobeChat, Chainlit and OpenHands are self-hosted web apps for AI chat and agents. This guide helps your AI assistant configure them securely, including loopback-only ports, LobeChat's registration allowlist, a Chainlit auth callback, and OpenHands reached only through an authenticated tunnel.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/chat-uis.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against AnythingLLM documentation (no recorded version), LobeHub v2.2.16, Docker CLI v27.5.1, Docker Compose v2.32.4, compose-go v2.4.7, Moby v27.5.1, and curl minimum write-out version 7.75.0; 6 further sources carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 30 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -49931,23 +50027,7 @@ REASONED: preceding block; isolation comparison, listener and external-reachabil
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/chat-uis.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -50009,7 +50089,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "a8ab396d9c1bb40454583d61e0e4744beaaa5f79069feb09514fede626474e5f",
+ "body_sha256": "a9847336a2a39bf79a5469467afc003a27b16269bf58717e83381db9075457ed",
"components": {
"anything": {
"name": "AnythingLLM documentation",
@@ -50159,6 +50239,24 @@ Claims (full source mapping in the JSON block below):
# LLM tracing and observability: Langfuse, Phoenix, Helicone, OpenTelemetry Collector
+Langfuse, Phoenix and Helicone record an AI app's prompts and responses; the OpenTelemetry Collector relays trace data. This guide helps your AI assistant configure each securely, including open signup off, authentication enabled where it ships disabled, private listeners, and TLS on Collector receivers, plus authentication on those taking off-host data.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/llm-observability.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Langfuse documentation (no recorded version), Phoenix listener source arize-phoenix-v20.16.0, OpenTelemetry Collector v0.161.0, Collector distributions v0.161.0, and curl minimum 7.75.0; 9 further sources are pinned to a commit and 4 carry no recorded version. Metadata reviewed 2026-10-17; documentation checked September 2026. The guide records 48 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -50541,23 +50639,7 @@ that accepts spans with no credential at all.
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/llm-observability.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -50642,7 +50724,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-17",
"documentation_checked": "2026-09",
- "body_sha256": "49cf8484be9817a2c60e5b7c478cdb97fdaa412fb555ac56cc03d63099b5ebe8",
+ "body_sha256": "bccda510424a75793de8f391c4d82138bbed715c67e81adacfb514c1b9c366f9",
"components": {
"langfuse": {
"name": "Langfuse documentation",
@@ -50864,6 +50946,24 @@ Claims (full source mapping in the JSON block below):
# Workflow and agent orchestrators: Prefect, Dagster, Airflow, Temporal, Flower, Argo
+Prefect, Dagster, Airflow, Temporal, Flower and Argo Workflows schedule, run or monitor jobs and pipelines, and their consoles and APIs can start code on workers. This guide helps your AI assistant configure each securely, including no public UI or API, MFA for people, separate machine-client credentials, and limited worker egress.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/workflow-orchestrators.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Prefect Basic Auth minimum 3.1.8, Dagster OSS 1.13.24, Apache Airflow 3.3.2, Temporal Go SDK codec source v1.28.0, Flower v2.2.0, Argo Workflows v3.7.18 and v4.1.4, Prefect Blocks source 3.1.8, and Apache Airflow historical configuration 2.11.0, plus 10 more recorded bases; 1 further source is pinned to a commit and 7 carry no recorded version. Metadata reviewed 2026-10-05; documentation checked October 2026. The guide records 62 claims: 3 demonstrated by a check that ran and 59 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -51345,23 +51445,7 @@ These defaults are checked against Prefect 3.1.8+ for Basic Auth, Dagster 1.13.x
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/workflow-orchestrators.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -51469,7 +51553,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-05",
"documentation_checked": "2026-10",
- "body_sha256": "fa18bb5bca5189881826e754d7d45b7a5179143b73c35dd0f654f46b3e7945b1",
+ "body_sha256": "d7680e74130e76721e3b4643260c974dab37029d366f90766e8bce403743319d",
"components": {
"prefect": {
"name": "Prefect Basic Auth minimum",
@@ -52158,6 +52242,24 @@ Claims (full source mapping in the JSON block below):
# Self-hosted observability components: node_exporter, Alertmanager, Pushgateway, Jaeger, and Loki
+node_exporter, Alertmanager, Pushgateway, Jaeger and Loki are monitoring services that usually run beside Prometheus, handling host metrics, alerts, pushed metrics, traces and logs. This guide helps your AI assistant configure each securely, including private listeners, each component's TLS and authentication options switched on, and a login proxy for browsers.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/observability-components.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against node_exporter v1.12.1, Alertmanager v0.34.1, Pushgateway v1.11.3, Jaeger v2.21.0, Loki v3.7.8, Exporter toolkit v0.17.1, OpenTelemetry configtls v1.66.0, and OpenTelemetry basicauth extension v0.160.0, plus 1 more recorded basis; 3 further sources are pinned to a commit and 1 carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 59 claims: 14 demonstrated by a check that ran and 45 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -52670,23 +52772,7 @@ from your own account's view of the process.
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/observability-components.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -52777,7 +52863,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "f45df859cb959c33bb27f11321b0c0ce89b86646e42b682ce29a8a31a314f7ae",
+ "body_sha256": "005f19103d8d98586c0210f7ab4cc5f9b4ed6e5a8ff8e08aff8e9cfe2c1688f2",
"components": {
"node": {
"name": "node_exporter",
@@ -54048,6 +54134,24 @@ Claims (full source mapping in the JSON block below):
# Firebase and Supabase: the rules are the security
+Firebase and Supabase are hosted app backends whose database, storage, sign-in and functions are called directly from client code. This guide helps your AI assistant configure each securely, including Firebase Security Rules or Supabase row-level security with grants, separately authorized functions and storage, and server keys kept off clients.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/firebase-supabase.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Firebase documentation (no recorded version), PostgreSQL invoker-view minimum 15, curl curl-8_14_1, and ShellCheck v0.11.0; 2 further sources carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 70 claims: 2 demonstrated by a check that ran and 68 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -55005,23 +55109,7 @@ REASONED: tool-version provenance for the historical local runs above; the [Shel
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/firebase-supabase.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -55116,7 +55204,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-19",
"documentation_checked": "2026-09",
- "body_sha256": "6690687db9e1d66f3e67a898fc0b030022e55be24166bc29b8c35554e8081891",
+ "body_sha256": "bbf1862c56fcb74db81c1981d8fea7f6d06de5733b616f2c54b21cea041ce073",
"components": {
"firebase": {
"name": "Firebase documentation",
@@ -55316,6 +55404,24 @@ Claims (full source mapping in the JSON block below):
# Self-hosted Supabase
+Supabase is an app backend that bundles a PostgreSQL database with sign-in, file storage and ready-made APIs. This guide helps your AI assistant configure a self-hosted Docker deployment securely, including every demo secret replaced before first start, published ports kept off the internet, and the `service_role` key guarded.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/supabase-self-hosted.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Supabase documentation (no recorded version) and curl curl-8_14_1; 4 further sources are pinned to a commit. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 28 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -55503,23 +55609,7 @@ The guide's `self-hosted/v0.8.1` version basis cites Compose at e693f206f5050b00
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/supabase-self-hosted.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -55572,7 +55662,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "7b148279d78c4f1bf31d47ab41b3c410c6840c43048393bba146da2d7184ac16",
+ "body_sha256": "283db5908cbcf4fb805283e12ff21328493cdaf4bd35382fcac2e71df553a225",
"components": {
"docs": {
"name": "Supabase documentation",
@@ -56164,6 +56254,24 @@ Claims (full source mapping in the JSON block below):
# WebSockets, server-sent events, and webhooks: authenticating the non-page endpoints
+WebSockets and server-sent events keep a connection open so a server can stream data to the browser; webhooks are requests other services send to notify your app. This guide helps your AI assistant secure these endpoints, including authenticated streams, verified webhook senders, bounded expensive endpoints, and restricted relay destinations.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/realtime-webhooks.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against WebSocket protocol RFC 6455, stripe-node v18.5.0, stripe-python v12.5.0, Traefik timeout reference v3.5, Caddy source v2.11.4, nginx source release-1.26.3, HAProxy 3.0, and HAProxy source v3.0.0, plus 1 more recorded basis; 7 further sources carry no recorded version. Metadata reviewed 2026-10-17; documentation checked September 2026. The guide records 36 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -56411,23 +56519,7 @@ Scope and revisions: browser behavior follows RFC 6455 and the HTML and Fetch li
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/realtime-webhooks.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -56498,7 +56590,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-17",
"documentation_checked": "2026-09",
- "body_sha256": "388feba84d8550e0fcda92145b4191091a4b2d2f17912f63bc753f9d7c00972c",
+ "body_sha256": "fbd1d55ce98188ac445231ccf908356fd6a89d142e6eaa4191eea28c7eebfc48",
"components": {
"websocket": {
"name": "WebSocket protocol",
@@ -58721,6 +58813,24 @@ Claims (full source mapping in the JSON block below):
# Nomad and Consul: the scheduler and service-mesh APIs
+Nomad decides which machines run your jobs, and Consul is a service directory and key-value store. This guide helps your AI assistant configure the Community Edition of each securely, including private listen addresses, default-deny ACLs on every agent, Nomad TLS and gossip encryption, and only local script checks in Consul.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/nomad-consul.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Nomad Community Edition 2.0.7 and Consul Community Edition 2.0.4. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 42 claims: 13 demonstrated by a check that ran and 29 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -59034,23 +59144,7 @@ give the host's public address. A "connected" on a port you did not mean to expo
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/nomad-consul.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -59113,7 +59207,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "05ae6961d3225ec0e28ef043428dfeea38f86a7be4cfd93f6a6d58b4990f084a",
+ "body_sha256": "2bbd8a4ce0b378526374bfb530815edc031f20476a76b1bbf0cd590d0e35d9ef",
"components": {
"nomad": {
"name": "Nomad Community Edition",
@@ -59203,6 +59297,24 @@ Claims (full source mapping in the JSON block below):
# Self-hosted backends: PocketBase and Appwrite
+PocketBase and Appwrite are self-hosted backends that give apps a database, user accounts and file storage through one API. This guide helps your AI assistant configure each securely, including private bootstrap, deliberate binding and TLS, access rules on every collection or resource, and server keys kept off clients.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/pocketbase.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against PocketBase v0.40.4, Appwrite 2.2.0, utopia-php/database 7.3.9, and curl curl-8_14_1; 2 further sources carry no recorded version. Metadata reviewed 2026-10-19; documentation checked September 2026. The guide records 75 claims: 2 demonstrated by a check that ran and 73 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -59899,23 +60011,7 @@ service result or deployed-bundle scan is claimed.
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/pocketbase.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -60015,7 +60111,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-19",
"documentation_checked": "2026-09",
- "body_sha256": "56cf568348e9a9e7890afd9133b526447b70bf593b07da5b93bedb63ce116e85",
+ "body_sha256": "1a5491a4947efad12d1c25ff16afa8a4c2dc02e0613cb404ad3b5511d57a483b",
"components": {
"pb": {
"name": "PocketBase",
@@ -60202,6 +60298,24 @@ Claims (full source mapping in the JSON block below):
# Headless browser services: Chrome DevTools Protocol, Selenium Grid, browserless, and Playwright server
+Chrome DevTools Protocol, Selenium Grid, browserless and Playwright server let programs control a real browser for testing, scraping or AI agents. This guide helps your AI assistant configure each securely, including automation ports on loopback or a restricted private network, authenticated remote access, limited browser egress, and protected connection URLs.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/headless-browser-services.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Chromium 154.0.8037.57, browserless (open source) 2.56.7, browserless Playwright file-protocol fix 2.51.0, Playwright source v1.58.2, and curl documentation curl-8_14_1; 2 further sources are pinned to a commit and 6 carry no recorded version. Metadata reviewed 2026-10-05; documentation checked October 2026. The guide records 32 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -60492,23 +60606,7 @@ missing files, authentication failures, connection failures, and timeouts are in
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/headless-browser-services.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -60572,7 +60670,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-05",
"documentation_checked": "2026-10",
- "body_sha256": "83eb3c90295cb9d91e397cfa9e10e498bcf3591cc59ea0b23a98e47d7021298b",
+ "body_sha256": "ebb4a62836b2de94321149bbe30a946e00bd1e41c808d1c02be928657667b931",
"components": {
"chromium": {
"name": "Chromium",
@@ -60734,6 +60832,24 @@ Claims (full source mapping in the JSON block below):
# Instant API backends: Strapi, Directus, Hasura, and PostgREST
+Strapi, Directus, Hasura and PostgREST are backend tools that give apps a generated API over your database. This guide helps your AI assistant configure each securely, including Strapi and Directus admins created privately, Hasura's admin secret set, PostgREST's role grants kept narrow, and secrets kept out of committed files.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/headless-cms-instant-api.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Strapi Users and Permissions source v5.58.0, Directus listener source v12.4.1, Directus quickstart 12.0.2, Hasura quickstart image 2.46.0, Hasura authentication-status minimum 2.48.0, and PostgREST listener source v16.4; 6 further sources carry no recorded version. Metadata reviewed 2026-09-27; documentation checked September 2026. The guide records 48 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -61112,23 +61228,7 @@ Version boundary at the time of writing: Strapi 5 documentation; current Directu
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/headless-cms-instant-api.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -61207,7 +61307,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-27",
"documentation_checked": "2026-09",
- "body_sha256": "52cb6bf055f819d9f1a2989a161eea24062bedbbc7b18ba52bab952e739e5d1e",
+ "body_sha256": "1da7b80791f7217c4a2edcee5bab9cf8879fdb6f2675692a32bd1bb94fbc6474",
"components": {
"strapi-signup-source": {
"name": "Strapi Users and Permissions source",
diff --git a/streamlit.md b/streamlit.md
index 0d85eacf6..4d6c7ed31 100644
--- a/streamlit.md
+++ b/streamlit.md
@@ -1,5 +1,23 @@
# Streamlit: TLS and authentication
+Streamlit is a Python library that turns data scripts into interactive web apps. This guide helps your AI assistant configure an app securely, including a loopback bind with TLS from a proxy or tunnel, a native OIDC login or an authenticating proxy, and reviewed uploads, static files and outbound traffic.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/streamlit.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Streamlit 1.64.0, Google OpenID Connect documentation rolling documentation, checked 2026-10-15, Authlib minimum 1.3.2, httpx minimum 0.24.1, Caddy v2.11.4, oauth2-proxy v7.15.4, Keycloak 26.7.4, and curl minimum write-out version 7.75.0; 3 further sources carry no recorded version. Metadata reviewed 2026-10-05; documentation checked October 2026. The guide records 35 claims: 12 demonstrated by a check that ran and 23 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -215,23 +233,7 @@ Source-checked on 2026-09-18 against Streamlit 1.64.0, the current release at th
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/streamlit.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -296,7 +298,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-05",
"documentation_checked": "2026-10",
- "body_sha256": "8f1af50b58ec9e65f321989751e1ee7d32e9d068e8bbd945a9fe571806ce9449",
+ "body_sha256": "c83bdc30997ec7651c814a21832622c8369ec43b9752c05c4a1130ac0e5a9f10",
"components": {
"streamlit": {
"name": "Streamlit",
diff --git a/supabase-self-hosted.md b/supabase-self-hosted.md
index 56ef4f369..bc2662076 100644
--- a/supabase-self-hosted.md
+++ b/supabase-self-hosted.md
@@ -1,5 +1,23 @@
# Self-hosted Supabase
+Supabase is an app backend that bundles a PostgreSQL database with sign-in, file storage and ready-made APIs. This guide helps your AI assistant configure a self-hosted Docker deployment securely, including every demo secret replaced before first start, published ports kept off the internet, and the `service_role` key guarded.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/supabase-self-hosted.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Supabase documentation (no recorded version) and curl curl-8_14_1; 4 further sources are pinned to a commit. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 28 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -187,23 +205,7 @@ The guide's `self-hosted/v0.8.1` version basis cites Compose at e693f206f5050b00
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/supabase-self-hosted.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -256,7 +258,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "7b148279d78c4f1bf31d47ab41b3c410c6840c43048393bba146da2d7184ac16",
+ "body_sha256": "283db5908cbcf4fb805283e12ff21328493cdaf4bd35382fcac2e71df553a225",
"components": {
"docs": {
"name": "Supabase documentation",
diff --git a/time-series-metrics-stores.md b/time-series-metrics-stores.md
index 573ae4cff..0c1de5e71 100644
--- a/time-series-metrics-stores.md
+++ b/time-series-metrics-stores.md
@@ -1,5 +1,23 @@
# Time-series and metrics stores: InfluxDB, VictoriaMetrics, and QuestDB
+InfluxDB, VictoriaMetrics and QuestDB are time-series databases: they store readings over time, like server metrics. This guide helps your AI assistant configure each securely, including InfluxDB 2.x setup finished privately and applications given scoped tokens, VictoriaMetrics cluster RPC ports limited to cluster members, and QuestDB's default database login changed.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/time-series-metrics-stores.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against InfluxDB OSS 2.x and 1.x, VictoriaMetrics single-node v1.152.0, VictoriaMetrics cluster v1.152.0-cluster, VictoriaMetrics shipped Compose image v1.151.0, and QuestDB Enterprise qualification 4.0.0; 2 further sources are pinned to a commit and 2 carry no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 45 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -214,23 +232,7 @@ REASONED: the VictoriaMetrics v1.152.0 single-node endpoint-key and Basic-auth c
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/time-series-metrics-stores.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -304,7 +306,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "e0da00137fe67ffece497c6157594e02a012c12e44d704253e4499707b36dc02",
+ "body_sha256": "c23bb50631d831bd18048dc9ccf27e744b89cd79d044c0023ea923a2ce381c72",
"components": {
"influx2": {
"name": "InfluxDB OSS",
diff --git a/tools/version_basis.py b/tools/version_basis.py
index a7d2e15ed..f7366d381 100644
--- a/tools/version_basis.py
+++ b/tools/version_basis.py
@@ -1235,7 +1235,7 @@ def main():
help='convert named legacy guides, preserving the digested body exactly')
modes.add_argument('--introduce', type=Path, metavar='GUIDE',
help='move a two-section prompt to the top and insert --intro text')
- parser.add_argument('--intro', help='one human-written paragraph for --introduce')
+ parser.add_argument('--intro', help='the reviewed intro paragraph for --introduce')
modes.add_argument('--rebind', type=Path, metavar='GUIDE',
help='assert the claim inventory was reviewed; update only its digest')
parser.add_argument('guide', nargs='?', type=Path,
diff --git a/vault.md b/vault.md
index 45a559215..dd72f5001 100644
--- a/vault.md
+++ b/vault.md
@@ -1,5 +1,23 @@
# HashiCorp Vault
+HashiCorp Vault is a secrets manager: applications fetch passwords, API keys and other credentials from it instead of keeping them in files. This guide helps your AI assistant make sure it is configured securely, including no dev mode in production, an enabled audit device, and narrowly scoped policies and tokens.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/vault.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Vault loopback run 2.1.1, Vault handler source v1.21.0, Vault forwarding source v1.20.0, Vault JWT audience minimum 1.17, Vault historical wrapping qualification 0.8, and curl minimum write-out version 7.75.0; 1 further source carries no recorded version. Metadata reviewed 2026-09-26; documentation checked September 2026. The guide records 36 claims: 16 demonstrated by a check that ran and 20 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -1147,23 +1165,7 @@ See [production firewall guidance](https://developer.hashicorp.com/vault/docs/co
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/vault.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -1225,7 +1227,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-09-26",
"documentation_checked": "2026-09",
- "body_sha256": "c0cc4cc8e447a97ecaf2d7468cc3b61f66ab601a32ecad3bd7ff8c892b95d894",
+ "body_sha256": "0bf7df3cd09be317f048df09313fb31631bc814a65264b021f701896d207297a",
"components": {
"run": {
"name": "Vault loopback run",
diff --git a/vector-databases.md b/vector-databases.md
index 46d8abe2c..ea1733eab 100644
--- a/vector-databases.md
+++ b/vector-databases.md
@@ -1,5 +1,23 @@
# Vector databases: Qdrant, Weaviate, Milvus, Chroma, pgvector
+Qdrant, Weaviate, Milvus and Chroma are vector databases that find text by meaning; pgvector adds this to PostgreSQL. This guide helps your AI assistant configure each securely, including Weaviate's anonymous access off, Milvus's default root password changed, and Chroma behind an authenticated TLS proxy, Cloudflare Tunnel with Access or tailnet.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/vector-databases.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Qdrant source v1.19.1, Weaviate source v1.39.6, Milvus v2.6.24 and v3.0.2, Milvus Helm chart 5.0.30, Milvus Operator v1.3.11, Chroma source 1.5.9, Chroma migration documentation v1.0.0, and pgvector source v0.8.2, plus 5 more recorded bases; 8 further sources carry no recorded version. Metadata reviewed 2026-10-15; documentation checked September 2026. The guide records 55 claims, all reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -278,23 +296,7 @@ REASONED: tenant isolation and bypass positive control. A live PostgreSQL with p
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/vector-databases.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -391,7 +393,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-15",
"documentation_checked": "2026-09",
- "body_sha256": "83c865153d5158fab30da3bb303117817f1cd6c1b1471dc48e0fbac05ec35363",
+ "body_sha256": "fc2918727d64bf41798db38364a7e8b86163fc4fb056a85b4a6cb21e3f26663b",
"components": {
"q": {
"name": "Qdrant source",
diff --git a/workflow-orchestrators.md b/workflow-orchestrators.md
index c7194aa11..d63cbca12 100644
--- a/workflow-orchestrators.md
+++ b/workflow-orchestrators.md
@@ -1,5 +1,23 @@
# Workflow and agent orchestrators: Prefect, Dagster, Airflow, Temporal, Flower, Argo
+Prefect, Dagster, Airflow, Temporal, Flower and Argo Workflows schedule, run or monitor jobs and pipelines, and their consoles and APIs can start code on workers. This guide helps your AI assistant configure each securely, including no public UI or API, MFA for people, separate machine-client credentials, and limited worker egress.
+
+
+
+If an AI assistant is helping you secure a deployment, give it the prompt below:
+
+```text
+Read the secureconfig guide at
+https://raw.githubusercontent.com/jposluns/secureconfig/main/workflow-orchestrators.md
+in full, including the section for AI assistants at the end. Then, for my
+deployment: state which of its recommendations apply and the exact changes
+to make; compare the versions the guide was written against with the
+releases I am running and with the vendor's current releases, and flag any
+guidance a newer release may have changed; and run or adapt the guide's
+Verify steps where you can. List separately every item you could not
+verify instead of reporting it as passed.
+```
+
Written against Prefect Basic Auth minimum 3.1.8, Dagster OSS 1.13.24, Apache Airflow 3.3.2, Temporal Go SDK codec source v1.28.0, Flower v2.2.0, Argo Workflows v3.7.18 and v4.1.4, Prefect Blocks source 3.1.8, and Apache Airflow historical configuration 2.11.0, plus 10 more recorded bases; 1 further source is pinned to a commit and 7 carry no recorded version. Metadata reviewed 2026-10-05; documentation checked October 2026. The guide records 62 claims: 3 demonstrated by a check that ran and 59 reasoned from cited sources.
A newer release of any of this software can make version-specific details here outdated. To prioritize an update, open a GitHub issue, send a pull request, add a request under [requests/](requests/README.md), or reach the maintainer as [CONTRIBUTING.md](CONTRIBUTING.md) describes. The machine-readable version basis and claim list are in [the section for AI assistants](#about-the-ai-assistant-section-below) at the end of this guide.
@@ -481,23 +499,7 @@ These defaults are checked against Prefect 3.1.8+ for Basic Auth, Dagster 1.13.x
## About the AI assistant section below
-The rest of this file is generated by the repository's tooling and written for AI assistants rather than for people. It records the versions this guide was written against, the guide's claims with a status for each (demonstrated by a check that ran, or reasoned from the cited sources), and the mapping from each claim to its sources. You are welcome to read it, but it is dense and can be hard to take in.
-
-If an AI assistant is helping you secure a deployment, give it the prompt below:
-
-```text
-Read the secureconfig guide at
-https://raw.githubusercontent.com/jposluns/secureconfig/main/workflow-orchestrators.md
-in full, including the section for AI assistants at the end. Then, for my
-deployment: state which of its recommendations apply and the exact changes
-to make; compare the versions the guide was written against with the
-releases I am running and with the vendor's current releases, and flag any
-guidance a newer release may have changed; and run or adapt the guide's
-Verify steps where you can. List separately every item you could not
-verify instead of reporting it as passed.
-```
-
-This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
+This generated section holds the recorded versions, claim statuses and source mappings for AI assistants; use [the prompt at the top](#ai-assistant-prompt). This guide is guidance to verify against your own deployment, not a certification, an audit, or a guarantee of compliance with any standard.
**Version basis**
@@ -605,7 +607,7 @@ Claims (full source mapping in the JSON block below):
"schema": 1,
"checked": "2026-10-05",
"documentation_checked": "2026-10",
- "body_sha256": "fa18bb5bca5189881826e754d7d45b7a5179143b73c35dd0f654f46b3e7945b1",
+ "body_sha256": "d7680e74130e76721e3b4643260c974dab37029d366f90766e8bce403743319d",
"components": {
"prefect": {
"name": "Prefect Basic Auth minimum",