RoastMyOpsecBlog
Exposure classes we keep seeing on marketing sites: secrets, VCS crumbs, maps, and treasure-map robots.txt. Ten guides per page.
Page 3 of 7
Vulnerabilities · May 11, 2025
Public package.json vs lockfile advisories is two ways your dependency story leaks. A 200 on /package.json with a JSON name field is an inventory gift on the marketing origin — versions, scripts, and sometimes private…
Read guide →Vulnerabilities · May 2, 2025
Public JavaScript API keys vs server secrets is a placement rule, not a naming trick. If a value is in HTML, a bundled .js file, or a public env prefixed for the client, it is public — assume it is copied. Server…
Read guide →Vulnerabilities · Apr 24, 2025
Production source maps leak when a public .js file points at a reachable .map, or when maps are uploaded next to hashed assets without access control. Maps are a debugging aid: they reconstruct original filenames,…
Read guide →Vulnerabilities · Mar 21, 2025
postMessage vs CORS for embedded widgets is two different cross-origin pipes. CORS decides whether fetch may read another origin's HTTP response. window.postMessage sends a structured clone to another window; CORS…
Read guide →Vulnerabilities · Mar 12, 2025
pnpm-lock.yaml vs package.json on a production origin is two Node inventory files that do not belong next to index.html. /package.json is declared dependencies — the roast signatures it. pnpm-lock.yaml is the exact pnpm…
Read guide →Vulnerabilities · Mar 4, 2025
phpMyAdmin vs /wp-admin on a public marketing origin is not a style contest. /wp-admin is the CMS staff door — still needs MFA, SSO, and rate limits, but its presence is normal. phpMyAdmin (and cousins like…
Read guide →Vulnerabilities · Feb 23, 2025
phpinfo() vs verbose API errors on production is two costumes of the same leak class. phpinfo() prints PHP version, extensions, paths, and often environment-shaped configuration into an HTML page. Verbose API errors…
Read guide →Vulnerabilities · Feb 15, 2025
.user.ini vs .htaccess on a production origin is two server config files that must not be downloadable next to index.html. .htaccess is Apache per-directory rules. .user.ini is PHP's per-directory INI. Both can name…
Read guide →Vulnerabilities · Nov 22, 2024
Open redirects vs tokens in URLs are two ways a public site donates trust. An open redirect lets a stranger pick the next location on your hostname. Tokens in query strings (reset links, OAuth codes, session ids) show…
Read guide →Vulnerabilities · Oct 27, 2024
.npmrc vs an npm token on a production origin is a leftover config file versus the credential that file often carries. A reachable /.npmrc is the same class of miss as /.env or /package.json: the marketing CDN served a…
Read guide →