moai-ref-secops

Apply the hardened-pod baseline: run as non-root, use a read-only root filesystem, drop all Linux capabilities, enable a seccomp profile, disable privileged mode and privilege escalation, and avoid host path mounts. Enforce this baseline at admission using PodSecurity restricted profile or a policy engine.

BOLA detection requires monitoring production traffic for one identity accessing object IDs outside its expected set. Enforcement demands a server-side ownership check on every object access, since client-side checks are never a trust boundary.

This skill covers the operational and runtime half of security: live traffic detection, gateway rate limiting, WAF tuning, and cluster hardening. moai-ref-owasp-checklist covers dev-time secure coding patterns like input validation, parameterized queries, and security headers.

IaC scanning must run before the apply stage, between plan and apply, failing closed on high-severity findings like public buckets or wildcard IAM policies. Scanning after apply is detection only, not prevention.

No. The reference is strictly defensive, framing every topic as misconfiguration, detection, and prevention. MITRE ATT&CK technique IDs are cited only to correlate defenses with the techniques they counter, never with exploitation procedures.