guest@geearr:~$ ls -lt ~/guides
Security field guides
Practical, vendor-neutral write-ups on the problems that come up in real engagements. Answer first, details after.
- 2026-10-124 min read
How to get DMARC to p=reject without breaking email
A step-by-step DMARC enforcement rollout: inventory senders, fix SPF’s 10-lookup limit, align DKIM, move from p=none to quarantine to reject, and lock down parked domains.~/guides/dmarc-p-reject.md - 2026-10-123 min read
Penetration test vs. vulnerability scan: what’s the difference?
How penetration tests and vulnerability scans differ, what scanners cannot find, which one PCI DSS 4.0, SOC 2 and HIPAA expect, and what a good pen test report contains.~/guides/pentest-vs-vulnscan.md - 2026-10-123 min read
Security checklist for AI-built (vibe-coded) apps
A practical pre-launch security checklist for apps built with Cursor, Claude, Lovable, Bolt or v0: secrets in bundles, Supabase RLS, server-side authorization, environments, backups and LLM agent risks.~/guides/ai-app-checklist.md - 2026-10-123 min read
OAuth 2.0 & OpenID Connect security review checklist
An OAuth 2.0 / OIDC security checklist based on RFC 9700: PKCE everywhere, exact redirect URI matching, strict JWT validation, token storage, refresh token rotation and sender-constrained tokens.~/guides/oauth-oidc-review.md
>>
Contact
guest@geearr:~$ finger george@geearr.com
┤ finger ├
- Login:
- george
- Name:
- George Rios
- Office:
- United States · remote
- Shell:
- /bin/zsh
- LinkedIn:
- linkedin.georgerios.com
- GitHub:
- github.com/noundry
Plan:
Find it before someone else does.
Tell me what you ship and what keeps you up at night. A free 30-minute scoping call gets you a clear plan and quote before any testing begins — whether or not we work together.
./book --scoping-call --freemail -s "engagement" george@georgerios.com
found a bug in this site? security.txt