---
title: "Vinícius Ornelas (@vini-ornelas) | Hashnode"
description: "Vinícius Ornelas (@vini-ornelas) writes on Hashnode. Read their latest articles and follow their work."
url: "https://hashnode.com/@vini-ornelas"
---

@vini-ornelas

# Vinícius Ornelas

@vini-ornelas · São Paulo, Brazil · Joined July 2026

### [Hardening CI/CD for a NAT-Bound Server: Self-Hosted to Tailscale](https://vini-ornelas.hashnode.dev/hardening-ci-cd-for-a-nat-bound-server-self-hosted-to-tailscale?utm_source=hashnode&utm_medium=feed)

Self-hosted runners on public repos grant root to any PR author. Here are 7 defense layers from SHA pinning to Tailscale WireGuard mesh.

7 min read · [vini-ornelas.hashnode.dev](https://vini-ornelas.hashnode.dev/hardening-ci-cd-for-a-nat-bound-server-self-hosted-to-tailscale?utm_source=hashnode&utm_medium=feed)

[Jul 13](https://hashnode.com/posts/hardening-ci-cd-for-a-nat-bound-server-self-hosted-to-tailscale/6a54ecb69f678af6d81baa5e)