Security

A post-incident review: how an unauthenticated SQL injection in Ghost's Content API (CVE-2026-26980) exposed an Admin API key on my hardened, self-hosted blog, and the controls that now break each step of the attack.

Learn how to self-host Ghost on a hardened Raspberry Pi using DevSec.io, automate security with GitHub Actions, and fix CSP challenges for a secure setup!