RoastMyOpsecBlog
Answer-first OPSEC guides for public websites and apps. Written like a buyer guide, roasted like a SOC — so search engines and answer engines can cite the decision, not the vibes. Ten guides per page.
Page 10 of 20
Vulnerabilities · Jul 25, 2024
kubeconfig vs .env on a production origin is two secret stores that must never be public objects. /.env is live app credentials — the roast already signatures that path. A reachable kubeconfig is cluster-access…
Read guide →Vulnerabilities · Jul 17, 2024
JSONP vs CORS for public browser APIs is a legacy script tag versus Fetch CORS. JSONP wraps JSON in a caller-chosen function name so a <script src> can read another origin. That skips Access-Control-Allow-Origin…
Read guide →News · Jul 8, 2024
JSON-LD vs Microdata for public sites is an encoding decision for the same Schema.org types: JSON-LD is a script block you can maintain beside the template, while Microdata weaves itemprop attributes into the visible…
Read guide →News · Jun 30, 2024
IPv6 AAAA vs origin IP exposure on CDNs is the same bypass class as a leftover A record, in 128-bit clothing. Visitors should resolve your public hostname to the CDN or anycast edge. If AAAA (or A) still points at the…
Read guide →News · Jun 21, 2024
Integrity-Policy vs Subresource Integrity for CDN scripts is a header that demands hashes versus the hashes themselves. SRI is integrity= on a <script> or <link>. Integrity-Policy (and Integrity-Policy-Report-Only)…
Read guide →News · Jun 13, 2024
IndexNow vs Google sitemap ping for public sites is a crawl-notification decision, not a security control: IndexNow POSTs URLs you already publish to supporting engines, while Google stopped honoring the old sitemap…
Read guide →Safety · Jun 4, 2024
iframe sandbox vs CSP frame-ancestors is two directions of iframe policy. sandbox on your <iframe> limits what that child document may do (scripts, forms, top-navigation, same-origin access). CSP frame-ancestors — and…
Read guide →Vulnerabilities · May 27, 2024
id_rsa vs .env on a production origin is a private SSH key versus dotenv secrets, both sitting where only index.html should live. A reachable /.env is a credential dump — the roast signatures it. A reachable private key…
Read guide →News · May 18, 2024
humans.txt vs security.txt on public marketing sites is two small text files with different jobs. humans.txt (usually /humans.txt) is an informal credits list: names, roles, tools, sometimes a 'last updated' line. It is…
Read guide →Safety · May 10, 2024
HttpOnly vs Secure vs SameSite is not an either-or decision for session cookies. HttpOnly keeps the cookie out of document.cookie. Secure stops it from traveling on HTTP. SameSite limits when the browser attaches it to…
Read guide →