Workstation ब्लॉग
Security
Security टैग वाली पोस्ट।
One Sign-In for Every App, Run on Our Own Cluster
Five demo apps in five languages never see a password and never talk to Google: they send users to a self-hosted OpsAPI, which signs them in and hands back a token the app checks with one API call. What it costs to add an app, why admin dashboards belong behind a VPN or zero-trust broker, and the honest limits.
Balinder Waliaपढ़ें 
Keep Your Test Sites Private: VPN at the Edge, One Sign-In for Every App
Staging and test sites hold real-looking data, yet they're often protected by an IP allowlist alone. Here's how two layers keep them private: a VPN checked at the edge proves where a request came from, and one OpsAPI sign-in with MFA proves who sent it, across every app.
Balinder Waliaपढ़ें 
Put Internal Apps Behind Your VPN, Without Rebuilding Them
Staging sites and admin panels are often 'private' because of an IP allowlist. Put them behind the wslvpn Zero Trust VPN, enforced at the WSLProxy edge: check the tunnel and the person, fail closed, and see why someone was blocked. One field per domain, no app changes, no reload.
Balinder Waliaपढ़ें 
Gemini 4 Argon: What It Means for Your Team, and Where to Use It First
Gemini 4 Argon is built to work for hours on one measurable problem. Here is what shipped, the real costs, and how to pilot it safely on your own backlog.
Balinder Waliaपढ़ें 
WSL Vault for Compliance: One Tenant Never Opens Another’s Secrets
How WSL Vault keeps app, team, and environment tenants cryptographically isolated — so a stolen root-style token cannot empty the estate — and why dual-tenant control beats secrets sprawl.
Balinder Waliaपढ़ें 
How We Protected the Payments Secure FinTech App with WSLProxy Edge, an Open-Source API Gateway
How we put WSLProxy Edge, our open-source API gateway, in front of Payments Secure (payments-secure.fictionally.org): real-IP checks, scanner detection, login throttling and audit logs, rolled out safely in audit mode.
Balinder Waliaपढ़ें 
WSLVault: Why AI Agents Need Cryptographic Secrets Isolation
AI agents use secrets at machine speed across tools and tenants. WSLVault seals per tenant so a shared platform never leaks another team's plaintext.
Balinder Waliaपढ़ें 
Jobshout SEO Analyst AI Agent — Analyse Any Website & Fix SEO Issues Automatically
We ran Jobshout SEO Analyst on workstation.co.uk — score 44/100 — with concrete fix prompts for missing H1, truncated title, and oversized meta description.
Balinder Waliaपढ़ें 
WSLVault: Steal the Server. Not the Secrets.
WSLVault seals secrets before they touch disk — DEK to tenant KEK to root KEK — so a stolen host still leaves attackers with ciphertext they cannot open.
Balinder Waliaपढ़ें 
How to Deploy Secure AI Agents in Healthcare
AI agents can book appointments, take payments and support clinical work. Here is how healthcare teams can give them the right access, and no more.
Balinder Waliaपढ़ें 
WSLProxy WAF Engine v2: Enterprise Enforcement You Can Explain
Workstation WSL Proxy WAF Engine v2: governed stages and signatures on the OpenResty hot path — explainable enforcement with support IDs.
Balinder Waliaपढ़ें WSL Proxy WAF: Explainable Web Application Firewall at the Edge
Workstation WSL Proxy WAF: governed stages and signatures on a live-config OpenResty edge — monitor or block, with explainable support IDs.
Balinder Waliaपढ़ें 
Workstation WSL प्रॉक्सी: API गेटवे, CDN और एजेंट एज
Workstation WSL प्रॉक्सी (WSLProxy) एक पूर्ण API गेटवे और CDN एज है: लाइव रूटिंग, WAF, कैश, मल्टी-पॉप DNS, MCP - एजेंट गेटवे और MCP गेटवे के साथ प्रगति पर है।
Balinder Waliaपढ़ें 
एजेंटिक AI सुरक्षा: MCP OAuth, VPN और HashiCorp Vault लीज़
MCP OAuth 2.1, VPN-आइसोलेटेड टूल्स, और ऑटो-रोटेट/एक्सपायर होने वाली HashiCorp Vault लीज़ से एंटरप्राइज़ AI एजेंट सुरक्षित करें — साथ में Claude, OpenAI और Cursor सुझाव।
Balinder Waliaपढ़ें 
NebulaDNS संपूर्ण फ़ीचर गाइड: k3s, Route53, ऑब्जर्वेबिलिटी, और एंटरप्राइज़ DNS
NebulaDNS सुविधाओं का पूरा दौरा: API-प्रथम नियंत्रण विमान, Prometheus मेट्रिक्स, प्रसार द्वार, सहकर्मी फ़िंगरप्रिंटिंग, DNSSEC रोडमैप, Helm/k3s ऑपरेटर कहानी, और AWS Route 53 और CoreDNS के साथ कैसे एकीकृत करें।
Balinder Waliaपढ़ें NebulaDNS: क्यों प्रामाणिक DNS AI युग में गेम चेंजर है
NebulaDNS एक API-प्रथम नियंत्रण विमान, Prometheus मेट्रिक्स, प्रसार द्वार और Kubernetes-मूल संचालन के साथ एक सुरक्षित-रस्ट आधिकारिक DNS सर्वर है - जिसे दृश्यता के लिए बनाया गया है जब AI सेवाएं और एजेंट पहले से कहीं अधिक DNS पर निर्भर होते हैं।
Balinder Waliaपढ़ें 
NebulaCR: एंटरप्राइज़ OCI रजिस्ट्री, अवलोकनशीलता, और बिना किसी समझौते के अनुपालन
NebulaCR का व्यावसायिक अवलोकन: नेबुला-रजिस्ट्री और नेबुला-ऑथ के साथ जंग OCI रजिस्ट्री, मनुष्यों और CI के लिए शून्य-विश्वास OIDC, SCIM जीवनचक्र, Prometheus और OpenTelemetry, बहु-क्षेत्र प्रतिकृति, पुल-थ्रू कैश और Kubernetes Helm परिनियोजन - अपस्ट्रीम डॉक्स / और README से संश्लेषित।
Balinder Waliaपढ़ें