RoastMyOpsecBlog
OPSEC signal for public sites and apps — what changed, what still leaks, and what to scan first. Ten guides per page.
Page 6 of 7
News · Aug 28, 2023
ETag vs Cache-Control for personalized pages is a byte validator versus who may store the response. Cache-Control (private, no-store, no-cache) says whether a shared CDN may keep the HTML. An ETag is a validator for…
Read guide →News · May 18, 2023
A defensive URL audit vs a penetration test is a scope and consent split. RoastMyOpsec is a consented self-audit of public HTTP, DNS, and optional GitHub for a URL you assert you own. It does not send exploit payloads,…
Read guide →News · May 10, 2023
Dangling CNAME vs abandoned SaaS subdomains is the same failure seen from two sides. A dangling CNAME is DNS that still points at a provider host after you deleted the project. An abandoned SaaS subdomain is the empty…
Read guide →News · Aug 10, 2022
Content-Language vs HTML lang for public sites is a header-versus-document decision: the lang attribute on <html> is what browsers, screen readers, and hyphenation use, while Content-Language is an HTTP metadata field…
Read guide →News · Aug 2, 2022
Consent-based URL scans vs unsolicited probing is the difference between a self-audit and someone else's problem. RoastMyOpsec is for a public HTTP URL you assert you control. Checks are reads, OPTIONS, bounded path…
Read guide →News · Jul 16, 2022
Client Hints vs User-Agent string fingerprinting is how browsers donate high-entropy client data. The classic User-Agent header is a messy banner every request already sends. User-Agent Client Hints (Sec-CH-UA,…
Read guide →News · Jun 12, 2022
CDN and WAF fingerprints vs origin exposure is inventory, not a pass/fail CVE. Headers that name Cloudflare, Akamai, Fastly, or Vercel tell you traffic is probably not hitting the app VM first. Missing those…
Read guide →News · Jun 3, 2022
CDN cache keys vs Cache-Control for personalized pages is two different caches. Cache-Control tells browsers and shared caches whether HTTP may store the response (public, private, no-store). The CDN cache key is how…
Read guide →News · Apr 30, 2022
Breadcrumb JSON-LD vs visible nav for public sites is a markup-versus-UI decision: BreadcrumbList should repeat a trail users can actually see and click, while primary nav is the site-wide menu and does not have to be a…
Read guide →News · Apr 22, 2022
BIMI vs DMARC for brand logos in the inbox is a display feature versus the authentication policy it sits on. DMARC (with SPF and DKIM) tells receivers what to do when From alignment fails. BIMI (Brand Indicators for…
Read guide →