RoastMyOpsecBlog
Answer-first OPSEC guides for public websites and apps. Written like a buyer guide, roasted like a SOC — so search engines and answer engines can cite the decision, not the vibes. Ten guides per page.
Page 19 of 20
Safety · Jun 20, 2022
Certificate expiry vs HSTS is not a pick-one control. A trusted, unexpired certificate is what makes this HTTPS visit work. HTTP Strict-Transport-Security is what tells browsers to skip HTTP next time. An expired or…
Read guide →News · Jun 12, 2022
CDN and WAF fingerprints vs origin exposure is inventory, not a pass/fail CVE. Headers that name Cloudflare, Akamai, Fastly, or Vercel tell you traffic is probably not hitting the app VM first. Missing those…
Read guide →News · Jun 3, 2022
CDN cache keys vs Cache-Control for personalized pages is two different caches. Cache-Control tells browsers and shared caches whether HTTP may store the response (public, private, no-store). The CDN cache key is how…
Read guide →Vulnerabilities · May 26, 2022
Cargo.toml vs package.json on production origins is two language manifests that must not sit next to index.html. /package.json donates npm names and versions. /Cargo.toml (and Cargo.lock) donates crate names, features,…
Read guide →Safety · May 17, 2022
Cache-Control public vs private is a shared-cache decision, not a performance slogan. public means a CDN or browser may store the response for reuse across users. private means only the end user's browser should keep…
Read guide →Safety · May 9, 2022
CAA records vs registrar lock are two different doors on the same house. Certification Authority Authorization (CAA) is a DNS record that tells public CAs which issuers are allowed to mint certificates for your domain.…
Read guide →News · Apr 30, 2022
Breadcrumb JSON-LD vs visible nav for public sites is a markup-versus-UI decision: BreadcrumbList should repeat a trail users can actually see and click, while primary nav is the site-wide menu and does not have to be a…
Read guide →News · Apr 22, 2022
BIMI vs DMARC for brand logos in the inbox is a display feature versus the authentication policy it sits on. DMARC (with SPF and DKIM) tells receivers what to do when From alignment fails. BIMI (Brand Indicators for…
Read guide →Vulnerabilities · Apr 13, 2022
backup.sql.gz vs dump.sql on a production origin is the same database souvenir in two costumes. /dump.sql is often schema and rows in text — the roast signatures SQL-shaped bodies on that well-known name. A .sql.gz is…
Read guide →Vulnerabilities · Apr 5, 2022
An AWS credentials file vs .env on a production origin is two containers for the same class of secret. /.env often holds AWS_ACCESS_KEY_ID-shaped values — the roast signatures that path. A copied credentials file from a…
Read guide →