01
A firewall rule that does not survive a reboot
What you saw
The rule is listed. Traffic is blocked. You saved it.
What was happening
Saving wrote the rule to a file that nothing loads at boot, because the service that restores it was never enabled. The rule was real until the next restart, and then silently was not.
Reboot, then check the rule is still there
# saving is not persisting
systemctl is-enabled netfilter-persistent
# the only honest test is a reboot, then re-list
iptables -S | head
A saved rule is not a persistent rule until something loads it.
02
The detection that found your own activity
What you saw
The rule fires. Detection works. There is the alert, right on schedule.
What was happening
The pattern matched the investigator's own commands moving through the logs. It had never once matched the thing it was written for, and nobody noticed because it kept producing hits.
Match structured fields, not free text you also generate
# match the field, not the substring
# then exclude your own session before you trust a single hit
A rule that fires on you is not evidence that it would fire on them.
03
A credential that still mounts and is no longer valid
What you saw
The share is mounted and readable, so the stored credential must be fine.
What was happening
The mount was established before the password changed and the kernel kept the session. Nothing re-authenticated, so nothing failed. The stored credential had been wrong for weeks.
Force a fresh authentication, do not read an old session
# an existing mount proves a past login, not a current credential
# unmount, then mount again from the stored secret
A working mount is not proof of a working credential.
04
Read-only is not safe to publish
What you saw
The dashboard is view-only, so sharing it is harmless.
What was happening
A panel rendered a value that was itself the secret — a webhook URL. Scanning for key names found nothing, because the risk was in the shape of the value, not in what the field was called.
Sweep by value shape before you expose anything
# key-name scanning misses secrets whose NAME is innocent
# search for the shape: long random tokens, full webhook URLs, bearer strings
Read-only controls who can write, not what they can read.
House rules: no real addresses, no real hostnames, no topology — every screen is
generic, scale figures only. No sponsors. Open-source tools get named; anything for-profit stays
generic. Every failure here happened in this rack.