RoastMyOpsecBlog
OPSEC signal for public sites and apps — what changed, what still leaks, and what to scan first. Ten guides per page.
Page 2 of 7
News · Nov 14, 2025
Shared Storage API vs Topics API for marketing sites is two Privacy Sandbox ads channels. Topics lets participating sites observe coarse interest topics the browser computed. Shared Storage lets an origin write data…
Read guide →News · Oct 28, 2025
Service workers vs Cache-Control for personalized pages is two caches. Cache-Control tells browsers and shared CDNs whether HTTP may store the response. A service worker sits in the page origin and can cacheRequest even…
Read guide →News · Oct 20, 2025
Server-Timing vs Server banners for stack fingerprints is two ways the origin writes its résumé into HTTP. Server and X-Powered-By are explicit product strings. Server-Timing is a performance header (metric name,…
Read guide →News · Oct 3, 2025
Server banners vs stack fingerprinting is a disclosure choice, not a cloak of invisibility. A versioned Server or X-Powered-By header hands strangers a tech résumé with every response. Removing those banners at the…
Read guide →News · Sep 24, 2025
security.txt vs a public /security contact page is a channel split, not a lock. RFC 9116 security.txt lives at https://example.com/.well-known/security.txt and tells researchers where to send a report (Contact, Expires,…
Read guide →News · Sep 15, 2025
security.txt Expires vs a stale Contact for public sites is a freshness decision versus an intake-mailbox decision: RFC 9116 requires an Expires timestamp so parsers know the file is still intended, while Contact is the…
Read guide →News · Sep 7, 2025
A security headers checklist for public websites is a browser-guardrail list, not a pentest. Ship Content-Security-Policy (start report-only if needed), Strict-Transport-Security with a long max-age, framing controls…
Read guide →News · Aug 12, 2025
RSS vs Atom for security blogs on public sites is a feed-format decision: Atom (RFC 4287) is the IETF XML format with clearer ids and dates, while RSS 2.0 remains the format most aggregators still auto-detect. Pick one…
Read guide →News · Jul 18, 2025
Related Website Sets vs partitioned cookies for brands is two ways browsers treat cookies across related origins. Partitioned cookies (CHIPS) isolate a third-party cookie per top-level site so site A and site B do not…
Read guide →News · Jul 9, 2025
rel=me vs sameAs for brand identity on public sites is a handshake-versus-claim decision: rel=me (microformats) is a public link meant to be reciprocal for IndieWeb-style verification, while schema.org sameAs is a…
Read guide →