RoastMyOpsecBlog
Exposure classes we keep seeing on marketing sites: secrets, VCS crumbs, maps, and treasure-map robots.txt. Ten guides per page.
Page 2 of 7
Vulnerabilities · Jan 21, 2026
Swagger UI vs GraphQL introspection on production APIs is two ways to publish the schema. Swagger UI /swagger, /docs, and /openapi.json are interactive catalogs. GraphQL introspection (__schema) is a query that dumps…
Read guide →Vulnerabilities · Jan 13, 2026
Subresource Integrity vs unpinned CDN scripts is a supply-chain control, not a speed debate. SRI (the integrity attribute) tells the browser to refuse a script or stylesheet whose hash does not match. Unpinned CDN URLs…
Read guide →Vulnerabilities · Dec 27, 2025
Spring Actuator vs Apache server-status on production is two live diagnostics that must not be world-readable. Actuator endpoints can expose env, beans, heap dumps, and gateway routes depending on what you enabled.…
Read guide →Vulnerabilities · Dec 1, 2025
Soft 404 vs hard 404 for sensitive paths is why status codes lie. A hard 404 (or 403/401) with a tiny generic body usually means the file is not there or is denied. A soft 404 is a 200 that returns your marketing HTML…
Read guide →Vulnerabilities · Nov 23, 2025
sitemap.xml vs robots.txt for hidden paths is an invitation versus a request. A sitemap is a list of URLs you want crawlers to fetch. robots.txt Disallow asks well-behaved bots not to crawl a prefix — it does not 403…
Read guide →Vulnerabilities · Oct 11, 2025
Apache server-status vs phpinfo() on production is two operator pages that must not be world-readable. mod_status /server-status lists workers, vhosts, and request lines. phpinfo() lists the PHP runtime. nginx…
Read guide →Vulnerabilities · Aug 4, 2025
robots.txt Disallow vs access control is a control-plane mismatch that shows up constantly on marketing sites. Disallow tells well-behaved crawlers not to fetch a path. It does not authenticate users, it does not block…
Read guide →Vulnerabilities · Jul 26, 2025
requirements.txt vs package.json on production origins is two language manifests that must not sit next to index.html. /package.json donates npm names and versions. /requirements.txt (and Pipfile, pyproject.toml,…
Read guide →Vulnerabilities · May 28, 2025
Rails master.key vs .env on a production origin is two ways to spill the app's secret material. /.env is plaintext runtime secrets — the roast signatures it. master.key is the key that unwraps Rails encrypted…
Read guide →Vulnerabilities · May 19, 2025
pubspec.yaml vs package.json on production origins is two language manifests that must not sit next to index.html. /package.json donates npm names and versions. /pubspec.yaml (and pubspec.lock) donates Dart and Flutter…
Read guide →