RoastMyOpsecBlog
Answer-first OPSEC guides for public websites and apps. Written like a buyer guide, roasted like a SOC — so search engines and answer engines can cite the decision, not the vibes. Ten guides per page.
Page 14 of 20
Vulnerabilities · Aug 20, 2023
.env.example vs .env on production origins is two files that must not sit next to index.html. /.env (and /.env.local) is live credentials: database URLs, API secrets, APP_KEY. /.env.example is supposed to be…
Read guide →Vulnerabilities · Aug 11, 2023
ELMAH vs trace.axd on production ASP.NET sites is two leftover operator UIs. ELMAH's /elmah.axd (and similar handlers) is an error log viewer: exception text, URLs, sometimes cookies or form fields depending on what was…
Read guide →Vulnerabilities · Aug 3, 2023
Exposed dump.sql vs backup.zip on production is the same class of miss in two costumes. A reachable SQL dump is often CREATE/INSERT text — schema and data that never belonged on the CDN. A reachable zip with PK magic is…
Read guide →Vulnerabilities · Jul 25, 2023
.DS_Store vs directory listing is two ways a static folder donates names. A public /.DS_Store (or one under /assets) is Apple Finder metadata that can include filenames from the folder someone synced. An 'Index of /'…
Read guide →Safety · Jul 17, 2023
Document-Policy vs Permissions-Policy for page features is two structured-header policies, not one misspelled header. Permissions-Policy (and legacy Feature-Policy) allowlists powerful APIs: camera, microphone,…
Read guide →Vulnerabilities · Jul 8, 2023
.dockerignore vs Dockerfile on a production origin is two build-context files that must not be public objects. /Dockerfile is the image recipe. /.dockerignore is the list of paths you kept out of the context — often the…
Read guide →Vulnerabilities · Jun 30, 2023
Dockerfile vs package.json on production origins is two build manifests on a public object store. /package.json donates dependency names and versions — useful for OSV homework, not a pentest. A public /Dockerfile (or…
Read guide →Safety · Jun 21, 2023
X-DNS-Prefetch-Control vs Referrer-Policy is two different gossip networks. Referrer-Policy limits what the next site sees in the Referer header — path, query, origin, or nothing. X-DNS-Prefetch-Control (and <link…
Read guide →Safety · Jun 13, 2023
DNS hygiene vs DNSSEC and registrar lock is a stack, not a single checkbox. Hygiene is knowing who your nameservers are, removing stale records, and using a registrar you can actually recover. Registrar transfer lock…
Read guide →Vulnerabilities · Jun 4, 2023
Directory listing vs 403 for backup and static folders is a map-versus-lock decision. Autoindex (an 'Index of /' HTML page) lists every file the web server will serve in that path — backups, old zips, leftover SQL…
Read guide →