# hugs4bugs.me
> Practical deep dives into cloud security, Microsoft Sentinel, Docker, DevSecOps, Security Architecture, and AI Security Frameworks by Shubhendu Shubham.

## About
- Author: Shubhendu Shubham
- Site: https://hugs4bugs.me
- Twitter: https://twitter.com/myselfshubhendu
- GitHub: https://github.com/sivolko
- LinkedIn: https://linkedin.com/in/shubhendu-shubham
- Topics: cybersecurity, cloud security, DevSecOps, Microsoft Sentinel, Docker, AI security, security architecture, AI security frameworks

## Content
This blog publishes technical tutorials, security research, and hands-on guides for SOC analysts, DevSecOps engineers, security architects, and cloud security practitioners.

## Posts
- /why-your-microsoft-sentinel-logic-apps-are-leaking-sensitive-credentials-during-automation/: Microsoft Sentinel Logic Apps playbooks leak secrets through run history and Log Analytics by default. Here's the exact leak path, KQL hunting query, a
- /why-ephemeral-docker-sandbox-environments-are-essential-for-secure-incident-response-analysis/: A plain docker run isn't a malware sandbox. Here's how to build an ephemeral, hardened Docker detonation chamber for incident response analysis.
- /why-you-still-need-a-siem/: Grafana and New Relic tell you your app is unhealthy. They won't tell you someone is inside it. Here's what a SIEM actually catches that they can't.Aft
- /why-ai-agent-poisoning-is-the-biggest-threat-to-soc-teams-in-2026/: AI agent poisoning bypasses prompt injection defenses and breaks SOC detection. A practitioner walkthrough of memory, tool, and RAG poisoning with KQL 
- /letting-gordon-migrate-your-dockerfile-to-dhi/: How Docker's Gordon AI assistant migrates Dockerfiles to Docker Hardened Images, what permissions it requests, and what to verify before approving.What
- /docker-hardened-images-migration/: How to move a Python service from a Docker Official Image to a Docker Hardened Image without breaking package installs, root permissions, or your entry
- /the-fifa-world-cup-bug-wasn-t-about-fifa/: How a public FIFA registration form exposed World Cup broadcast controls, and how to test your own APIs for the same client-side authorization flaw.
- /how-a-single-photo-can-silently-own-your-mac-via-exiftool/: CVE-2026-3102 lets attackers hide shell commands inside image metadata and execute them on macOS via ExifTool 13.49. Here's exactly how it works and ho
- /take-care-of-your-agent/: Agentic AI security for CISOs and architects: MCP vulnerabilities, OWASP Agentic Top 10, Anthropic's espionage case study, and NHI governance controls
- /your-ide-just-got-pwned-the-nx-console-supply-chain-attack/: Nx Console v18.95.0 was compromised via a stolen GitHub token on May 18, 2026. Learn what the payload did, IoCs to check, and how to fully recover
- /locking-down-vs-code-extensions-in-the-enterprise-lessons-from-the-github-breach/: How GitHub got breached via VS code malicious extensions, how to prevent it
- /tls-automation-isn-t-optional-anymore-here-s-what-that-means-for-your-stack/: TLS certificate Automation
- /docker-agent-building-your-own-ai-agent-teams-from-the-terminal/: A practical guide to what is a Docker Agent — the open-source framework for building AI agent teams. Includes working YAML configs, filesystem and shel
- /ndr-vs-edr-vs-xdr-a-deep-technical-breakdown-for-security-engineers/: Most teams deploy EDR and call it done. This breakdown covers what NDR, EDR, and XDR each actually see, where they go blind without each other, and how
- /docker-scout-security-policy-a-technical-deep-dive/: A technical guide to Docker Scout's Policy Evaluation — covering all nine policy types, real Dockerfile and CI/CD code snippets, and how to enforce sup
- /build-threat-hunting-IOC-with-elastic-siem/: Let's learn how to hunt Threat adversory
- /MPIC for All: An Open Approach to Certificate Security/: Let's learn what's beyond the HTTPs
- /is-your-ssh-port-a-security-time-bomb-understand-wazuh-audit-insights/: Learn how default SSH configurations, such as using port 22, can expose your system to security risks. This blog dives into Wazuh audit insights and pr
- /Your-AI-AgentExfiltrated-YourSSH-Keys/: Exploring the security implications when AI agents have access to sensitive credentials and how approval workflows can inadvertently enable data exfilt
- /logicapps-vs-securitycopilot/: Let's understand Sentinel Auth Method Won't Wake You at 3 AM?
- /best-ms-sentinel-authentication-method/: Let's understand Sentinel Auth Method Won't Wake You at 3 AM?
- /email-security-is-broken/: Logic Behind D3-SRA
- /made-your-reset-vulnerability/: beyond HHTP/2 Security
- /SIEM-doneright-3-stages-roadmap-that-actually-works/: I've seen hundreds of SIEM deployments fail, Here's what actually works. The 3 stages roadmap for SIEM deployement for cybersecurity or SOC team
- /no-more-secrets-in-terraform-statefile-write-only-arguments/: Let's understand what's new write only arguments in terraform 1.11, how IaaC engineers no need to store secrets in state file
- /snyk-saved-my-project-ft-uncontrolled-resource-consumptionn/: Redirect
- /snyk-saved-my-project-ft-uncontrolled-resource-consumption/: Let's understand uncontrolled resource consumption vulnerability
- /how-snyk-broker-solves-enterprise-integration-puzzle/: Let's understand what is Snyk Broker and how it's solving enterprise problems
- /DNS4EU-How-europe-just-built-a-dns-killer/: DNS4EU went live in June 2025 as Europe's first sovereign DNS resolver. This technical review covers its 5 resolver configs, Whalebone threat intel, GD
- /be-a-detective-with-aws-detective/: Let's deep dive into AWS Detective services
- /stop-fighting-local-llm-docker-just-fixed-mess-model-runnner/: Run LLM with Docker Model Runner
- /ship-ai-tools-like-app-with-docker-mcptoolkit/: Leverage Docker to build production ready MCP
- /The-cybersecurity-duel-trust-boundary-vs-attack-surface-explained/: Let's get concept clear what's Log analytics and log analytics workspace
- /how-and-why-to-upgrade-wazuh-4.10-using-docker/: In this section we'll see how effortlessly we can upgrade wazuh from v4.9.0 to v10.0 using docker in kali linux
- /best-way-tofool-yourself-enablinng-sms-based-2FA/: Let's get concept clear what's Log analytics and log analytics workspace
- /demystifying-loganalytics-vs-log-analytics-workspace-in-MS-Sentinel/: Confused between Log Analytics and Log Analytics Workspace in Microsoft Sentinel? Clear breakdown of the architectural difference, cost implications, a
- /wazuh's-big-move-from-elasticsearch-to-opensearch/: Wazuh dropped Elasticsearch for OpenSearch at v4.3 due to SSPL licensing. Here is why it happened, what changed technically, and how to choose between 
- /streamline-security-wazuh-in-docker/: Enhance your security operations with wazuh for real time threat detection and complicane using open source SIEM wazuh using docker with kali.
- /automate-multiple-loginfailure-alerts-response/: In this section we'll cover up basic but important challange faced by SOC analyst bu automating the multiple login failure alerts response
- /why-new-session-should-be-created-during-user-authentication/: In this section we'll see importance of session cookies, browsers request handling and security authentication
- /how-to-install-kali-purple-SOC-tools-on-top-of-existing-kali-machine/: Step-by-step guide to install Kali Purple SOC tools on existing Kali Linux. Covers all 5 NIST framework tools: Identify, Protect, Detect, Respond, Reco
- /living-without-passwords/: This is FIDO 2 Protocol which helps organisation,end users to adopt passwordless mindset with passkeys.
- /tools-that-SOC-security-analys-should-know/: This is curated list of awesome Security Analyst tool used by SOC/Security Analyst.
- /how-to-integrate-docker-scout-with-azure-container-registry/: This blog is about how to integrate docker scout with ACR(Azure Container Registry)
- /How-to-install-threatmapper-in-kali-linux/: This is to install Open source CNAPP tool Threat Mapper in Kali Machine
- /How-to-onboard-your-Microsoft-Sentinel-from-scratch/: This is all about how to configure Microsoft Sentinel environment with Log Analytics workspace
- /cloud-native-CNAPP-tool-Microsoft-defender-for-cloud-101/: let's understand what makes Microsoft Defender for cloud unique as CNAPP tool
- /What-is-Microsoft-Defender-Threat-Intelligence(MDTI)/: Automatically send email with attachment via Microsoft logic apps and Blob storage
- /send-email-with-Azure-logic-app/: Automatically send email with attachment via Microsoft logic apps and Blob storage
- /how -to-manage-azure-active-directory-objects/: Atomatically deploy your webapps with Github actions and firebase hosting with Jekyll templates
- /automation-with-firebase-and-ruby/: Atomatically deploy your webapps with Github actions and firebase hosting with Jekyll templates
- /useful-cybersecurity-search-engines/: This is a curated list of all types of search engines as a cybersecurity one should explore !
- /what-is-chat-gpt/: What is the difference between Kali Linux and Parrot os. Which is good for beginers and pro in cyber security and why do we need both?
- /what-is-difference-between-ls-and-ls-lrt-command/: What is the use of ls -lrt?
- /kali-linux-vs-parrot-linux/: What is the difference between Kali Linux and Parrot os. Which is good for beginers and pro in cyber security and why do we need both?
- /blue-team-vs-red-team-in-cyber-security/: What is the difference between Blue and Red Team in cyber security and why do we need both?
- /difference-between-WAF-and-IPS/: What is the difference between WAF and IPS system and why do we need both?
- /waf-vs-firewall/: This is the series of cloud security . Anyone can learn this series, start exploring and learn cloud security.
- /college-to-cyber-security/: This is the series of cloud security . Anyone can learn this series, start exploring and learn cloud security.
- /metasploitFramework-vs-metasploit-pro/: This is the series of cloud security . Anyone can learn this series, start exploring and learn cloud security.
- /Progressive-webapps-on-azure/: Let's build and deploy PWA over azure cloud from Scratch.
- /access-management-101/: Beasic understandings of Access Management and AAA concept.
- /how-to-automate-tweets-via-github-actions/: How you ever seen add to home screen or install popup on .
- /Progressive-web-app/: How you ever seen add to home screen or install popup on .
- /the-blue-team-protecting-you/: In cybersecurity, we have our own form of tackel box. We have our own versions of wiggly things.Let's learn few of the frameworks,tools and term from t
- /storing-and-managing-secrets-using-azure-vault/: This is fundamental blog of how to manage and store secrets like certificates, passwords using Azure vault .
- /2021-08-2-Understanding-basics-of-security/: This is fundamental blog of network security 101 with role as an azure developer,solution architect,administrator requires knowledge of the foundations
- /Fundamentals-of-Network-security/: This is fundamental blog of network security 101 with role as an azure developer,solution architect,administrator requires knowledge of the foundations
- /computer-networking-basics/: Learn basics of Computer Netoworking with hugs4bugs.The best beginers computer networking solution.
- /bulid-and-deploy-MERN-stack-in-Azure-cosmos-DB/: How to build and deploy A MERN stack application on Microsoft azure from scratch step-by-step.Best Steps for beginers 101.
- /best-linux-cheatsheet-101/: Best Linux cheat sheet for begineer to advance level.
- /azure-networking-101/: What is docker and how to learn fast.
- /Docker-101/: What is docker and how to learn fast.
- /benifits-of-CI/: How to use Continuous integration and Delivery in our project.
- /Automation-with-Jenkins-and-Github/: How to automate a project with Jenkins and Github
- /how-to-like-instagram-post-with-javascript/: how to increase instagram follower using script to add like counts.
- /How-to-install-Jenkins-on-Linux/: what is jenkins and how to install in our system.How to use it in our project
## Topics covered
- Microsoft Sentinel: authentication, KQL queries, analytics rules, SOAR playbooks
- Docker & Containers: sandboxing, secrets management, container security, runtime security
- DevSecOps: CI/CD pipeline security, GitHub Actions, IaC scanning, SLSA framework
- AI Security: agent risks, prompt injection, LLM red teaming, AI security frameworks
- Security Architecture: threat modeling, zero trust, cloud security design, STRIDE
- Cloud Security: AWS, Azure, GCP misconfigurations, CSPM
- AppSec: CVE triage, DMARC/DKIM/SPF, supply chain attacks, OWASP Top 10