RoastMyOpsecBlog
Exposure classes we keep seeing on marketing sites: secrets, VCS crumbs, maps, and treasure-map robots.txt. Ten guides per page.
Page 1 of 7
Vulnerabilities · Aug 31, 2026
yarn.lock vs package.json on a production origin is two Node inventory files that must not sit next to index.html. /package.json donates names and versions — the roast signatures a JSON body with a name field. yarn.lock…
Read guide →Vulnerabilities · Jul 19, 2026
wp-config.php.bak vs .env on production origins is two costumes of live secrets in the document root. /.env holds framework secrets. wp-config.php is supposed to be executed as PHP, not served as text — but editors…
Read guide →Vulnerabilities · Jul 10, 2026
WordPress XML-RPC vs wp-login.php is a two-door problem on a lot of marketing CMSs. wp-login.php is the browser form. xmlrpc.php is a legacy remote-procedure endpoint that can still authenticate users if it is enabled.…
Read guide →Vulnerabilities · Jul 2, 2026
WordPress debug.log vs framework debug on production is two leftover operator surfaces. WP_DEBUG plus WP_DEBUG_LOG writes PHP notices and often paths into wp-content/debug.log — a file that too often is fetchable as a…
Read guide →Vulnerabilities · Jun 15, 2026
WebSockets vs CORS for browser APIs is two different browser gates. CORS decides whether fetch/XHR may read a cross-origin HTTP response. A WebSocket starts as HTTP Upgrade; after the handshake, frames are not…
Read guide →Vulnerabilities · May 3, 2026
.vscode vs .DS_Store on production origins is two leftover folders next to index.html. .DS_Store is Apple Finder metadata that can list filenames. .vscode (and JetBrains .idea) is editor config: launch.json, tasks.json,…
Read guide →Vulnerabilities · Apr 25, 2026
Verbose API errors vs generic client messages is a production-logging split. Clients should get a short, stable code and a human sentence that does not name files, SQL, or framework versions. Operators should get the…
Read guide →Vulnerabilities · Feb 24, 2026
Timing-Allow-Origin vs CORS is two different yeses. CORS (Access-Control-Allow-Origin and friends) is whether another origin's JavaScript may read the body and many headers. Timing-Allow-Origin (TAO) is whether the…
Read guide →Vulnerabilities · Feb 16, 2026
Thumbs.db vs .DS_Store on production CDNs is the same OPSEC class in two operating-system costumes. .DS_Store is Apple Finder folder metadata. Thumbs.db (and ehthumbs.db) is a Windows thumbnail cache that can list image…
Read guide →Vulnerabilities · Jan 30, 2026
Terraform tfstate vs .env on a production origin is two files that must never be public objects. /.env is app secrets — the roast signatures it. terraform.tfstate is a JSON snapshot of infrastructure that HashiCorp…
Read guide →