RoastMyOpsecBlog
OPSEC signal for public sites and apps — what changed, what still leaks, and what to scan first. Ten guides per page.
Page 5 of 7
News · May 1, 2024
HTTP/2 vs HTTP/3 for public marketing sites is which application protocol the edge offers after TLS, not whether the URL is HTTPS. HTTP/2 (h2) multiplexes streams over TLS/TCP. HTTP/3 (h3) multiplexes over QUIC/UDP.…
Read guide →News · Apr 14, 2024
HTTP 103 Early Hints vs Content-Security-Policy is a speed header versus an allowlist. 103 (RFC 8297) lets a CDN or origin send Link: rel=preload (and similar) while the document is still generating. That is not a…
Read guide →News · Mar 3, 2024
hreflang vs canonical on a single-language public site is an international-targeting decision versus a duplicate-URL decision: skip hreflang until you ship real language or region variants, and use canonical (plus 301s)…
Read guide →News · Feb 23, 2024
How to read an OPSEC score (1–10) on a public URL: start at the top of the scale and subtract for evidence-backed misses on that response — headers, TLS, cookies, exposed paths, client-side secrets, and the rest of the…
Read guide →News · Feb 6, 2024
Host header vs SNI on shared TLS for public sites is a name-binding decision: SNI (RFC 6066) tells the TLS stack which certificate to present, while the HTTP Host header (RFC 9110) tells the origin which virtual host to…
Read guide →News · Jan 20, 2024
GPC vs DNT for public sites is a privacy-signal decision: DNT (Do Not Track) is a legacy header most sites ignore, while Global Privacy Control (Sec-GPC) is the browser signal many US state privacy laws treat as a…
Read guide →News · Dec 26, 2023
GitHub Actions write-all vs least-privilege permissions is a CI identity decision, not a website header. permissions: write-all (or a default token that can push, contents, and more than the job needs) turns a…
Read guide →News · Nov 22, 2023
fetchpriority vs loading=lazy for public sites is a competing-hints decision: loading=lazy defers offscreen images, while fetchpriority=high asks the browser to fetch a resource sooner — usually the LCP hero. Do not…
Read guide →News · Nov 4, 2023
Fenced frames vs iframe sandbox for ads embeds is two isolation costumes. iframe sandbox on a child you include limits scripts, forms, and same-origin access for that document. A fenced frame (<fencedframe>) is a…
Read guide →News · Oct 27, 2023
FedCM vs third-party cookies for federated login is two ways a site can recognize a user who already has an account at an identity provider. Unpartitioned third-party cookies let an IdP iframe or redirect see a shared…
Read guide →