RoastMyOpsecBlog
Answer-first OPSEC guides for public websites and apps. Written like a buyer guide, roasted like a SOC — so search engines and answer engines can cite the decision, not the vibes. Ten guides per page.
Page 12 of 20
News · Feb 6, 2024
Host header vs SNI on shared TLS for public sites is a name-binding decision: SNI (RFC 6066) tells the TLS stack which certificate to present, while the HTTP Host header (RFC 9110) tells the origin which virtual host to…
Read guide →Vulnerabilities · Jan 29, 2024
GraphQL introspection vs production APIs is a schema-publication choice, not an automatic CVE. Introspection lets clients query __schema and learn types, fields, and arguments. That is appropriate for public developer…
Read guide →News · Jan 20, 2024
GPC vs DNT for public sites is a privacy-signal decision: DNT (Do Not Track) is a legacy header most sites ignore, while Global Privacy Control (Sec-GPC) is the browser signal many US state privacy laws treat as a…
Read guide →Vulnerabilities · Jan 12, 2024
go.mod vs package.json on production origins is two language manifests that must not sit next to index.html. /package.json donates npm names and versions. /go.mod (and go.sum) donates module paths, Go version, and…
Read guide →Vulnerabilities · Jan 3, 2024
.gitmodules vs .git/HEAD on a production origin is a submodule inventory file versus proof the git directory is on the CDN. A reachable /.git/HEAD with a ref: signature is a VCS dump class finding — the roast already…
Read guide →News · Dec 26, 2023
GitHub Actions write-all vs least-privilege permissions is a CI identity decision, not a website header. permissions: write-all (or a default token that can push, contents, and more than the job needs) turns a…
Read guide →Vulnerabilities · Dec 17, 2023
Gemfile vs package.json on production origins is two language manifests that must not sit next to index.html. /package.json donates npm names and versions. /Gemfile (and Gemfile.lock) donates Ruby gems and pins — the…
Read guide →Vulnerabilities · Dec 9, 2023
Framework debug mode vs verbose API errors is a global switch versus one noisy response. APP_DEBUG=true, Django DEBUG=True, Rails consider_all_requests_local, and similar flags turn 500s into inventory: paths, config…
Read guide →Vulnerabilities · Nov 30, 2023
firebase.json vs package.json on production origins is two project files that must not sit next to index.html. /package.json donates npm names and versions. /firebase.json donates Firebase Hosting rewrites, redirects,…
Read guide →News · Nov 22, 2023
fetchpriority vs loading=lazy for public sites is a competing-hints decision: loading=lazy defers offscreen images, while fetchpriority=high asks the browser to fetch a resource sooner — usually the LCP hero. Do not…
Read guide →