Notes on cloud security, detection engineering, and the discipline of building things that hold.
Most organizations put a WAF or CDN in front of their applications and assume the job is done. But if the origin server is still reachable from the internet, attackers can bypass those protections entirely. In this article, I share what I've learned on how outbound-only tunnels remove inbound exposure.