RoastMyOpsecBlog
OPSEC signal for public sites and apps — what changed, what still leaks, and what to scan first. Ten guides per page.
Page 3 of 7
News · Jul 1, 2025
rel=canonical vs a 301 for duplicates on public sites is a stay-versus-move decision: a 301 tells clients and crawlers the old URL is gone, while rel=canonical is a hint that two live URLs represent the same document.…
Read guide →News · Jun 5, 2025
Rate limits vs CAPTCHA on public login is a layered abuse decision, not a single widget. Rate limits (and WAF bot rules) cap how often /login, /oauth/token, and password-reset can be hit from a network. CAPTCHA and…
Read guide →News · Apr 15, 2025
Private State Tokens vs CAPTCHA for public login is two abuse-control costumes. CAPTCHA (and similar challenges) raises the cost of each attempt in the browser. Private State Tokens (formerly Trust Tokens) let a…
Read guide →News · Mar 29, 2025
preload vs modulepreload for public pages is a resource-hint decision: rel=preload fetches a specific asset early with an as= type, while rel=modulepreload is for ES modules and can fetch the module graph. Use preload…
Read guide →News · Jan 12, 2025
Pagination rel=next vs a view-all page for public sites is a series-architecture decision: Google no longer treats rel=next/prev as a ranking signal, so crawlable page-N URLs or a single view-all document have to stand…
Read guide →News · Jan 3, 2025
OSV lockfile advisories vs a public URL OPSEC scan are two inventories. A URL roast sees what browsers already get: headers, cookies, mixed content, path leaks, and secret-shaped strings in public JavaScript. An OSV…
Read guide →News · Dec 9, 2024
Organization JSON-LD vs WebSite JSON-LD for public sites is an entity-versus-origin decision: Organization describes the brand (name, logo, sameAs profiles), while WebSite describes this site (url, name, optional…
Read guide →News · Nov 30, 2024
OpenID Discovery vs security.txt on public origins is login metadata versus researcher contact. https://issuer.example/.well-known/openid-configuration (OpenID Connect Discovery) lists authorization, token, and JWKS…
Read guide →News · Nov 13, 2024
Open Graph vs Twitter Cards for public sites is a preview-vocabulary decision: Open Graph (og:title, og:description, og:image, og:url) is the common unfurl format, while Twitter/X Cards add twitter:card and related…
Read guide →News · Nov 5, 2024
OCSP stapling vs Must-Staple for public certificates is a server-sent revocation hint versus a certificate extension that demands it. Stapling (OCSP in the TLS handshake) saves clients a trip to the CA and hides those…
Read guide →