Security Audit: Hardening folk.zone After Spam Attack
Hello, first off my apologies for not updating this project sooner. I have been busy with my writing and other initatives, but that is no excuse. I will try to ensure these updates are more regular moving forward.
On August 10, 2026, I conducted a security audit of the folk.zone infrastructure. This audit revealed some issues that required immediate attention, particularly with the WriteFreely instance.
What I Found
WriteFreely Compromised
The most serious finding was that the WriteFreely instance at write.folk.zone had been overrun by spam bots. With open registration enabled, automated bots created 569 fake users and published 526 spam posts in Thai language promoting online gambling and casinos.
The spam accounts followed clear patterns:
- Generic usernames with random numbers (e.g., "nora25724176", "jade16631554")
- Pattern-based usernames (e.g., "cybersky89", "skyember4902")
- Mass account creation throughout July 2026
Other Issues
Forgejo (git.folk.zone): Multiple SSH brute force attacks from various IP addresses attempting to access the Git service using invalid usernames.
URL Shortener (go.folk.zone): Path traversal attacks attempting to access sensitive system files through URL encoding bypass attempts.
BookWyrm (books.folk.zone): Automated vulnerability scanning attempting to discover sensitive configuration files (all attempts blocked).
Countermeasures Taken
WriteFreely Cleanup
I took action to clean up the WriteFreely instance:
- Disabled open registration to prevent future spam account creation
- Removed spam users and posts from the database
- Restarted the service with new security settings
During this cleanup, I was too aggressive in removing accounts and may have deleted some legitimate early users who signed up before the spam wave began. I should have used a more conservative approach, such as only removing accounts created after a certain date or those with obvious spam patterns. I sincerely apologize for this error and will be much more careful with user data in the future.
Forgejo Security Hardening
- Enabled rate limiting in Forgejo configuration
- Set rate limiting recovery time to 60 seconds
- Set memory duration to 30 minutes
- Restarted the service
Other Services
- Reviewed all service logs for suspicious activity
- Confirmed no successful breaches
- Verified security headers are configured across all services
Lessons Learned
This audit taught me a few lessons:
- Rate Limiting: Rate limiting should be enabled on all authentication endpoints by default
- Monitoring: Automated security monitoring and alerting is essential
- Conservative Cleanup: When dealing with user data, use conservative approaches and always ask before destructive actions
Moving Forward
The homelab is now more secure with proper rate limiting, disabled open registration on vulnerable services, and enhanced monitoring. I've implemented a regular security audit schedule and will be more vigilant about monitoring for suspicious activity.
The security of folk.zone and the privacy of its users remain my top priorities.
New Service: Webmention
I'm pleased to announce that webmention.folk.zone has been added to the folk.zone infrastructure. This service provides webmention support for the IndieWeb, allowing sites to send and receive webmentions for better cross-site conversation and interaction.
Lemmy Status Update
The Lemmy instance at lemmy.folk.zone is now operational and ready for use. After some initial setup and configuration, the federated link aggregation and discussion platform is stable and accepting new communities.
If you have any concerns about your account or data, please reach out to me at p@brennan@social.lol.