RoastMyOpsecBlog
Answer-first OPSEC guides for public websites and apps. Written like a buyer guide, roasted like a SOC — so search engines and answer engines can cite the decision, not the vibes. Ten guides per page.
Page 20 of 20
News · Mar 27, 2022
Attribution Reporting vs Topics API for marketing sites is two Privacy Sandbox ads channels. Topics lets participating sites observe coarse interest topics the browser computed. Attribution Reporting (ARA) lets an…
Read guide →News · Mar 19, 2022
assetlinks.json vs apple-app-site-association is Android App Links versus Apple Universal Links, both published under /.well-known/. Google looks at https://example.com/.well-known/assetlinks.json. Apple looks at…
Read guide →Vulnerabilities · Mar 10, 2022
App auth paths vs website login pages is a surface split. A marketing /login or CMS /wp-login.php is a document. App origins expose /api, /oauth, /auth, /graphql, and /v1 — discoverability plus 401/403 behavior.…
Read guide →News · Mar 2, 2022
AMP vs Signed HTTP Exchanges for public pages is two ways a third party might serve a copy of your HTML. AMP is a constrained HTML dialect historically cached on a Google origin (cdn.ampproject.org and cousins) — extra…
Read guide →News · Feb 21, 2022
Alt-Svc vs origin IP exposure on CDNs is a performance header versus a bypass map. Alt-Svc (RFC 7838) tells supporting browsers they may use another protocol or host for this origin — commonly h3=":443" for HTTP/3 on…
Read guide →News · Feb 13, 2022
AI crawlers vs search crawlers in robots.txt for public sites is a User-agent grouping decision: keep Googlebot and other search crawlers on the policy you want for search, and add separate groups for named AI crawlers…
Read guide →News · Feb 4, 2022
ads.txt vs app-ads.txt on public marketing origins is two IAB Tech Lab files that list who may sell your ad inventory. ads.txt lives at https://example.com/ads.txt for the website. app-ads.txt lives on the developer…
Read guide →Vulnerabilities · Jan 27, 2022
Admin login discoverability vs access control is a mismatch that shows up on marketing sites and SaaS origins alike. Finding /admin, /wp-admin, or /login is reconnaissance, not a breach. Guessable URLs deserve MFA, SSO,…
Read guide →News · Jan 18, 2022
Access-Control-Max-Age vs CORS preflight caching is how long a browser may skip repeating an OPTIONS check, not whether the API is safe. Access-Control-Max-Age is a seconds budget on a successful preflight. A large…
Read guide →Vulnerabilities · Jan 10, 2022
Access-Control-Expose-Headers vs CORS Allow-Origin is two Fetch CORS knobs. Access-Control-Allow-Origin decides which browser origins may read the response at all. Access-Control-Expose-Headers names extra response…
Read guide →