RoastMyOpsecBlog
Answer-first OPSEC guides for public websites and apps. Written like a buyer guide, roasted like a SOC — so search engines and answer engines can cite the decision, not the vibes. Ten guides per page.
Page 13 of 20
Safety · Nov 13, 2023
Sec-Fetch-Site vs Origin for CSRF defense is two browser-supplied labels, not a token replacement. Sec-Fetch-Site is Fetch Metadata: same-origin, same-site, cross-site, or none (user-initiated, no referrer). Origin is…
Read guide →News · Nov 4, 2023
Fenced frames vs iframe sandbox for ads embeds is two isolation costumes. iframe sandbox on a child you include limits scripts, forms, and same-origin access for that document. A fenced frame (<fencedframe>) is a…
Read guide →News · Oct 27, 2023
FedCM vs third-party cookies for federated login is two ways a site can recognize a user who already has an account at an identity provider. Unpartitioned third-party cookies let an IdP iframe or redirect see a shared…
Read guide →Safety · Oct 18, 2023
Feature-Policy vs Permissions-Policy is the same job under a new header name. Feature-Policy was the experimental name. Permissions-Policy is the standardized header that tells the browser which powerful APIs this…
Read guide →Vulnerabilities · Oct 10, 2023
Exposed .svn vs .git on production websites is the same incident class in two version-control costumes. A public /.git/HEAD (and the objects beside it) can donate source, history, and sometimes secrets that were…
Read guide →Vulnerabilities · Oct 1, 2023
An exposed Procfile vs package.json on a production origin is two process maps that must not sit next to index.html. /package.json donates scripts and dependency names — the roast signatures it. A Procfile donates…
Read guide →Vulnerabilities · Sep 23, 2023
Exposed .hg vs .git on production websites is the same incident class in two DVCS costumes. A public /.git/HEAD (and the objects beside it) can donate source, history, and sometimes secrets that were committed. A public…
Read guide →Vulnerabilities · Sep 14, 2023
Exposed .git vs .env on production is not a ranking of which leak is 'less bad.' A reachable .env is usually a credential dump — API keys, database URLs, signing secrets. A reachable .git tree is a source and history…
Read guide →Safety · Sep 6, 2023
Expect-CT vs Certificate Transparency is a leftover header versus a living ecosystem. Expect-CT told browsers to require CT evidence and optionally report failures. Chrome dropped enforcement; MDN marks the header…
Read guide →News · Aug 28, 2023
ETag vs Cache-Control for personalized pages is a byte validator versus who may store the response. Cache-Control (private, no-store, no-cache) says whether a shared CDN may keep the HTML. An ETag is a validator for…
Read guide →