Sloppify

ideas/security-privacy/attack-surface-monitor.md

@@ -0,0 +1,25 @@
+# Attack Surface Monitor
+
+Continuously monitor internet-exposed assets, detect changes in attack surface, and report newly introduced security risks.
+
+## Problem
+Exposed services change over time, and unnoticed drift can introduce high-risk entry points.
+
+## Core capabilities
+- Discover external assets: domains, ports, endpoints, and certificates.
+- Detect newly exposed services and configuration drift.
+- Run lightweight vulnerability checks with severity scoring.
+- Produce prioritized remediation tasks with owner mapping.
+
+## MVP scope
+- Scheduled external scan with baseline comparison.
+- Alerts for new open ports and expired certificates.
+- Weekly risk report with top findings.
+
+## Success criteria
+- Faster visibility into exposure drift.
+- Reduced time to remediate high-risk findings.
+
+## Stretch ideas
+- Integrate with change management to link exposure to recent deploys.
+- Auto-open hardening pull requests for common misconfigurations.

ideas/security-privacy/secrets-scanner.md

@@ -0,0 +1,25 @@
+# Secrets Scanner
+
+Continuously scan repositories and local environments for exposed credentials before they reach production or public history.
+
+## Problem
+Accidental secret leaks happen quickly and can remain unnoticed long enough to be exploited.
+
+## Core capabilities
+- Detect API keys, tokens, and private keys with pattern and entropy checks.
+- Scan commits, pull requests, and working directories.
+- Trigger rotation workflows and incident checklists on detection.
+- Suppress known false positives through scoped allow rules.
+
+## MVP scope
+- Pre-commit hook and CI pipeline integration.
+- Alerting to chat and issue tracker.
+- Baseline scan across existing repository history.
+
+## Success criteria
+- Fewer leaked credentials reaching remote repositories.
+- Faster incident response when leaks are detected.
+
+## Stretch ideas
+- Automatic secret revocation through provider APIs.
+- Developer education snippets in alert messages.

ideas/security-privacy/self-hosted-auth-manager.md

@@ -0,0 +1,25 @@
+# Self-Hosted Auth Manager
+
+Centralize authentication and authorization for self-hosted services using consistent SSO and OAuth policies.
+
+## Problem
+Self-hosted stacks often accumulate fragmented login systems, creating security gaps and admin overhead.
+
+## Core capabilities
+- Unified identity provider for internal tools.
+- Role and group mapping across services like Gitea, dashboards, and admin panels.
+- MFA enforcement and session policy controls.
+- Audit logs for access events and permission changes.
+
+## MVP scope
+- Deploy with one identity backend and two relying-party integrations.
+- Define baseline role model and default access policies.
+- Add admin UI for user lifecycle management.
+
+## Success criteria
+- Fewer account management tasks across services.
+- Improved access consistency and security posture.
+
+## Stretch ideas
+- Just-in-time privileged access workflows.
+- Risk-based auth prompts based on context and device posture.