RoastMyOpsecBlog
OPSEC signal for public sites and apps — what changed, what still leaks, and what to scan first. Ten guides per page.
Page 1 of 7
News · Aug 13, 2026
X-Robots-Tag vs meta robots for public sites is a delivery-channel decision: the HTTP header works on HTML and non-HTML, while the robots meta tag only exists on HTML documents. Pick the header for PDFs, images, and…
Read guide →News · Jun 23, 2026
change-password well-known vs a custom /reset URL is a pointer versus the actual form. WICG / RFC 8615 well-known URIs put a redirect at https://example.com/.well-known/change-password so browsers and password managers…
Read guide →News · Jun 6, 2026
Website OPSEC vs app OPSEC is a scan-mode choice on the same public URL, not two different products. Website mode emphasizes marketing-site hygiene: headers, cookies, trackers, robots.txt, mixed content. App mode leans…
Read guide →News · May 29, 2026
Webmention vs Pingback for public blogs is a notification-protocol decision: Webmention (W3C) is a simple HTTP mention flow, while Pingback is an older XML-RPC handshake still enabled on many WordPress origins. Prefer…
Read guide →News · May 20, 2026
WebAuthn vs passwords for public site login is an authenticator-bound credential versus a string people reuse. Passkeys (WebAuthn / FIDO2) prove possession of a device-bound key, often with a biometric or PIN on that…
Read guide →News · May 12, 2026
Web app manifest vs public metadata on production is a PWA catalog versus other JSON you accidentally ship. /manifest.webmanifest or /manifest.json names the app, icons, start_url, and display mode so installing the…
Read guide →News · Apr 16, 2026
URL scan vs GitHub deepen is a visibility split, not two competing products. A public URL audit sees what the internet already gets: headers, cookies, mixed content, robots.txt, and well-known path leaks. GitHub deepen,…
Read guide →News · Mar 22, 2026
Topics API vs third-party cookies for marketing sites is two advertising identity models. Third-party cookies (especially unpartitioned SameSite=None) let an embed recognize the same browser across sites. The Topics API…
Read guide →News · Mar 5, 2026
TLS 1.2 vs TLS 1.3 for public marketing sites is which handshake the edge offers, not whether the URL is HTTPS. TLS 1.3 is the current generation: fewer round trips, no renegotiation theater, modern AEAD-only ciphers.…
Read guide →News · Feb 7, 2026
Third-party trackers vs first-party analytics is a blast-radius choice, not a reporting feature checklist. A third-party pixel executes someone else's JavaScript in your users' browsers. First-party analytics collects…
Read guide →