Guides
Findings we actually hit, and what to do about them
Most security write-ups end at "remove it." That's fine until you're the one whose reverse proxy stops routing, or whose control panel dies two minutes after you follow the advice.
These are field notes from real production servers - including our own. Each one covers the same four things: what the finding means, why it's worse than it looks, why you often can't just delete it, and what to do instead.
Mounting docker.sock into a container is root on the host
It isn't a bug - it's the Docker API working as designed. Why Traefik, Portainer and Watchtower all want it, why removing it breaks them, and how a socket proxy gives them what they need and nothing else.
6 min read · 15 July 2026
A sudo wildcard is a root shell with extra steps
NOPASSWD:/some/dir/* looks scoped. It isn't. Why control panels ship it, why deleting the line stops the panel, and what to do when you're stuck with it - worked through on our own server.
7 min read · 15 July 2026
Why your nginx deny all never fires
The rule is in the config, nginx -t passes, and the file is still served. Why regex order decides everything, the ^~ modifier nobody uses, and why your .htaccess never sees a CSS request.
7 min read · 16 July 2026
.git in the webroot: why a 404 doesn't mean you're safe
We curled our own server, got a 404, and called it clean. Then we listed the directory. What an exposed repository really gives away, and how to keep git pull while removing the file.
7 min read · 16 July 2026
Rather just find out what's on yours?
Every finding in these guides is something owlzops-mapper detects. It's a single static binary, read-only, and nothing leaves your server. Run it and read the output - we're not in the room.