RoastMyOpsecBlog
Exposure classes we keep seeing on marketing sites: secrets, VCS crumbs, maps, and treasure-map robots.txt. Ten guides per page.
Page 4 of 7
Vulnerabilities · Oct 10, 2024
Next.js .env.local vs .env on a production origin is two dotenv files that must not be public objects. Next.js loads .env.local as a local override — teams still copy it into the static export. /.env is the shared file.…
Read guide →Vulnerabilities · Jul 25, 2024
kubeconfig vs .env on a production origin is two secret stores that must never be public objects. /.env is live app credentials — the roast already signatures that path. A reachable kubeconfig is cluster-access…
Read guide →Vulnerabilities · Jul 17, 2024
JSONP vs CORS for public browser APIs is a legacy script tag versus Fetch CORS. JSONP wraps JSON in a caller-chosen function name so a <script src> can read another origin. That skips Access-Control-Allow-Origin…
Read guide →Vulnerabilities · May 27, 2024
id_rsa vs .env on a production origin is a private SSH key versus dotenv secrets, both sitting where only index.html should live. A reachable /.env is a credential dump — the roast signatures it. A reachable private key…
Read guide →Vulnerabilities · Apr 23, 2024
HTTP TRACE vs least-privilege methods is a verb-surface choice. TRACE (and the old TRACK alias) should not be on the menu for a public origin. OPTIONS may advertise Allow or Access-Control-Allow-Methods; listing…
Read guide →Vulnerabilities · Apr 6, 2024
.htaccess vs web.config on a public origin is Apache per-directory config versus IIS/ASP.NET config sitting in the document root. Both are meant for the server, not for browsers. If GET /.htaccess or /web.config returns…
Read guide →Vulnerabilities · Jan 29, 2024
GraphQL introspection vs production APIs is a schema-publication choice, not an automatic CVE. Introspection lets clients query __schema and learn types, fields, and arguments. That is appropriate for public developer…
Read guide →Vulnerabilities · Jan 12, 2024
go.mod vs package.json on production origins is two language manifests that must not sit next to index.html. /package.json donates npm names and versions. /go.mod (and go.sum) donates module paths, Go version, and…
Read guide →Vulnerabilities · Jan 3, 2024
.gitmodules vs .git/HEAD on a production origin is a submodule inventory file versus proof the git directory is on the CDN. A reachable /.git/HEAD with a ref: signature is a VCS dump class finding — the roast already…
Read guide →Vulnerabilities · Dec 17, 2023
Gemfile vs package.json on production origins is two language manifests that must not sit next to index.html. /package.json donates npm names and versions. /Gemfile (and Gemfile.lock) donates Ruby gems and pins — the…
Read guide →