用 Claude Code 对所有 VPS 做安全审计的实战记录
levelsio 把 Claude Code 当运维用，对每台 VPS 跑安全审计，连 Tailscale 隔离策略都让 AI 生成，独立开发者可以直接抄这套做法。
levelsio 在自己的每台 VPS 和网站上让 Claude Code 执行"do a full security audit"全量安全审计。他的服务器此前已配置 Ubuntu 自动无人值守安全更新（每几周重启约 4 分钟），并用 Claude Code 生成的策略将各 VPS 通过 Tailscale 隔离，被入侵的机器无法访问其他 VPS 或他的 MacBook、iPhone。Web 服务权限也限定在 www-data 用户下避免拿到 root。他提出每月应留一周做"security week"，认为攻防两侧的模型能力目前大体对等。
Yesterday I spent all day typing this into Claude Code:
"Do a full security audit of this website and server"
On every single VPS (and site) I have
I already had automatic unattended upgrades with auto reboot for security updates in Ubuntu (reboot only takes 4 minutes so I think it's fine every few weeks)
Also isolated each VPS on Tailscale with special security policies (generated by Claude Code! so it can not access any other VPS (in case it gets hacked) and not even access my MacBook or iPhone unless I talk to it first
Also lots of user permission stuff isolating stuff to www-data to avoid root access for web services
Not the most fun stuff but essential
I think in addition to @yongfook's "marketing week" we now have to add one week per month of "security week" because with the models getting better our pre-emptive defense has to get better too
Luckily for us I think the attack and defense capabilities of AI models seems to somewhat match? So as long as we keep typing "do a security audit" regularly into our clanker we can keep it safe
I hope 🫨
