---
title: Security
canonical: 'https://www.dealmobile.co.uk/writing/tag/security'
url: 'https://www.dealmobile.co.uk/writing/tag/security'
type: Tags
---

# Security

## [Safe by default: a local AI server and a cheap model with a shell](https://www.dealmobile.co.uk/writing/safe-by-default-a-local-ai-server-and-a-cheap-model-with-a-shell.md)

Published 2026-10-25

A hardening pass on Mullet: a local server that a web page could not be stopped from calling, tools that fetched any address, and cheap models with more tools than they needed. What each guard checks and where to change it.

## [Running your own Claude subscription unattended](https://www.dealmobile.co.uk/writing/running-your-own-claude-subscription-unattended.md)

Published 2026-10-25

Mullet 2 drives your own claude -p, touches no credentials, pauses at usage limits, and reads usage from the statusline. Plus an API key trap worth knowing.

## [Sandboxing an AI coding worker](https://www.dealmobile.co.uk/writing/sandboxing-an-ai-coding-worker.md)

Published 2026-10-25

How Mullet 2 keeps a coding worker in a private clone behind bubblewrap, and what probing the real Claude Code binary turned up that the docs did not.

## [Cloning every repository without a token in the URL](https://www.dealmobile.co.uk/writing/cloning-repositories-without-a-token-in-the-url.md)

Published 2026-10-21

How GitHub Auditor keeps a clone of every repository up to date, gives git its token through a short-lived GIT_ASKPASS script instead of the URL, and reports force pushes, dirty clones and deleted repositories.

## [Fetching a feed from a URL you don’t trust](https://www.dealmobile.co.uk/writing/fetching-feeds-from-untrusted-urls.md)

Published 2026-10-20

How RSS to JSON stops a feed URL from reaching private addresses on the server’s own network, by checking every address a host resolves to, pinning the connection to the one it checked, and checking every redirect again.

## [Making large uploads resumable with TurboPush](https://www.dealmobile.co.uk/writing/making-large-uploads-resumable.md)

Published 2026-10-19

How TurboPush splits big files into chunks, retries the ones that fail, carries on after a page reload, and keeps the PHP side safe when chunks arrive twice or all at once.

---

Index of this site: [llms.txt](https://www.dealmobile.co.uk/llms.txt)