RoastMyOpsecBlog
Answer-first OPSEC guides for public websites and apps. Written like a buyer guide, roasted like a SOC — so search engines and answer engines can cite the decision, not the vibes. Ten guides per page.
Page 15 of 20
Vulnerabilities · May 27, 2023
desktop.ini vs Thumbs.db on production CDNs is two Windows leftovers next to index.html. desktop.ini is a folder-customization file (icon, InfoTip, localized name) that can list paths and sometimes point at a .ico you…
Read guide →News · May 18, 2023
A defensive URL audit vs a penetration test is a scope and consent split. RoastMyOpsec is a consented self-audit of public HTTP, DNS, and optional GitHub for a URL you assert you own. It does not send exploit payloads,…
Read guide →News · May 10, 2023
Dangling CNAME vs abandoned SaaS subdomains is the same failure seen from two sides. A dangling CNAME is DNS that still points at a provider host after you deleted the project. An abandoned SaaS subdomain is the empty…
Read guide →Safety · May 1, 2023
DANE TLSA vs CAA for public site certificates is two DNS controls that people mix up. CAA (RFC 8659) tells CAs which issuers may mint a cert for the name — a policy the CA ecosystem is supposed to honor. DANE (RFC 6698)…
Read guide →Safety · Apr 23, 2023
CSRF tokens vs SameSite is a pairing, not an either-or contest. SameSite on the session cookie reduces how often a foreign site can attach credentials to a request. Anti-CSRF tokens (or Fetch metadata / Origin checks)…
Read guide →Safety · Apr 14, 2023
CSP worker-src vs script-src is two different script surfaces. script-src allowlists JavaScript that runs in the page. worker-src allowlists URLs that may be used as Worker, SharedWorker, and Service Worker scripts. If…
Read guide →Safety · Apr 6, 2023
CSP vs X-Frame-Options is a choice between a modern framing policy and a legacy header that older browsers still understand. Content-Security-Policy frame-ancestors is the stronger, more precise control for new sites.…
Read guide →Safety · Mar 28, 2023
CSP style-src vs unsafe-inline for public sites is how you allow first-party CSS without inviting injected style tags. style-src lists which stylesheets and inline style blocks may apply. 'unsafe-inline' lets any inline…
Read guide →Safety · Mar 20, 2023
CSP strict-dynamic vs nonce host allowlists is two ways to trust scripts after you already have a nonce or hash: the nonce marks the tags you meant to run, a host list allows every file on that origin, and…
Read guide →Safety · Mar 11, 2023
CSP script-src-elem vs script-src for public sites is a split allowlist versus the combined one. script-src-elem governs <script> elements (src and inline script blocks). script-src-attr governs event-handler attributes…
Read guide →