Hardening CI/CD for a NAT-Bound Server: Self-Hosted to TailscaleSelf-hosted runners on public repos grant root to any PR author. Here are 7 defense layers from SHA pinning to Tailscale WireGuard mesh.7 min read·vini-ornelas.hashnode.devJul 13
