---
title: "Matt Brown (@mattbrownsec) | Hashnode"
description: "From policy to runtime: open source security in the real world. Read the latest articles by Matt Brown on Hashnode."
url: "https://hashnode.com/@mattbrownsec"
---

@mattbrownsec

# Matt Brown

@mattbrownsec · San Francisco · Joined May 2025

From policy to runtime: open source security in the real world.

### [Trivy Operator: The Scanner That Leaves Receipts](https://cloudsecburrito.com/trivy-operator-the-scanner-that-leaves-receipts?utm_source=hashnode&utm_medium=feed)

A practical walkthrough of how Trivy Operator turns image, config, secret, and RBAC findings into Kubernetes-native reports.

15 min read · [cloudsecburrito.com](https://cloudsecburrito.com/trivy-operator-the-scanner-that-leaves-receipts?utm_source=hashnode&utm_medium=feed)

[Jun 4](https://hashnode.com/posts/trivy-operator-the-scanner-that-leaves-receipts/6a21f0db318ee8975e1fa63b)

### [Deploying OSS Kubernetes Security Console](https://cloudsecburrito.com/deploying-oss-kubernetes-security-console?utm_source=hashnode&utm_medium=feed)

Welcome to the Jungle

10 min read · [cloudsecburrito.com](https://cloudsecburrito.com/deploying-oss-kubernetes-security-console?utm_source=hashnode&utm_medium=feed)

[Jun 4](https://hashnode.com/posts/deploying-oss-kubernetes-security-console/6a20f25c2f611e6372ca185e)

### [Building an OSS Kubernetes Security Console with MCP](https://cloudsecburrito.com/building-an-oss-kubernetes-security-console-with-mcp?utm_source=hashnode&utm_medium=feed)

Turning open source security signals into an agent-ready investigation layer

12 min read · [cloudsecburrito.com](https://cloudsecburrito.com/building-an-oss-kubernetes-security-console-with-mcp?utm_source=hashnode&utm_medium=feed)

[May 28](https://hashnode.com/posts/building-an-oss-kubernetes-security-console-with-mcp/6a189bbe782587548330aa2d)

### [From Capabilities to AppArmor: Layering Linux Runtime Security](https://cloudsecburrito.com/from-capabilities-to-apparmor-layering-linux-runtime-security?utm_source=hashnode&utm_medium=feed)

Capabilities, seccomp, and AppArmor working together to shut down the bad stuff

10 min read · [cloudsecburrito.com](https://cloudsecburrito.com/from-capabilities-to-apparmor-layering-linux-runtime-security?utm_source=hashnode&utm_medium=feed)

[Apr 27](https://hashnode.com/posts/from-capabilities-to-apparmor-layering-linux-runtime-security/69efa8bb330a1ad7f7120809)

### [Distroless Removes the Shell, Not the Risk](https://cloudsecburrito.com/distroless-removes-the-shell-not-the-risk?utm_source=hashnode&utm_medium=feed)

No bash, no curl, still getting \*\*\*\* done

12 min read · [cloudsecburrito.com](https://cloudsecburrito.com/distroless-removes-the-shell-not-the-risk?utm_source=hashnode&utm_medium=feed)

[Apr 20](https://hashnode.com/posts/distroless-removes-the-shell-not-the-risk/69e6822bc9501dd01028f99b)