RoastMyOpsecBlog
Answer-first OPSEC guides for public websites and apps. Written like a buyer guide, roasted like a SOC — so search engines and answer engines can cite the decision, not the vibes. Ten guides per page.
Page 3 of 20
Safety · Mar 13, 2026
TLS-RPT vs MTA-STS for SMTP failure reports is telemetry versus policy. MTA-STS (RFC 8461) publishes how sending MTAs should use TLS to your MX. TLS-RPT (RFC 8460) is a DNS TXT on _smtp._tls that names a mailbox or…
Read guide →News · Mar 5, 2026
TLS 1.2 vs TLS 1.3 for public marketing sites is which handshake the edge offers, not whether the URL is HTTPS. TLS 1.3 is the current generation: fewer round trips, no renegotiation theater, modern AEAD-only ciphers.…
Read guide →Vulnerabilities · Feb 24, 2026
Timing-Allow-Origin vs CORS is two different yeses. CORS (Access-Control-Allow-Origin and friends) is whether another origin's JavaScript may read the body and many headers. Timing-Allow-Origin (TAO) is whether the…
Read guide →Vulnerabilities · Feb 16, 2026
Thumbs.db vs .DS_Store on production CDNs is the same OPSEC class in two operating-system costumes. .DS_Store is Apple Finder folder metadata. Thumbs.db (and ehthumbs.db) is a Windows thumbnail cache that can list image…
Read guide →News · Feb 7, 2026
Third-party trackers vs first-party analytics is a blast-radius choice, not a reporting feature checklist. A third-party pixel executes someone else's JavaScript in your users' browsers. First-party analytics collects…
Read guide →Vulnerabilities · Jan 30, 2026
Terraform tfstate vs .env on a production origin is two files that must never be public objects. /.env is app secrets — the roast signatures it. terraform.tfstate is a JSON snapshot of infrastructure that HashiCorp…
Read guide →Vulnerabilities · Jan 21, 2026
Swagger UI vs GraphQL introspection on production APIs is two ways to publish the schema. Swagger UI /swagger, /docs, and /openapi.json are interactive catalogs. GraphQL introspection (__schema) is a query that dumps…
Read guide →Vulnerabilities · Jan 13, 2026
Subresource Integrity vs unpinned CDN scripts is a supply-chain control, not a speed debate. SRI (the integrity attribute) tells the browser to refuse a script or stylesheet whose hash does not match. Unpinned CDN URLs…
Read guide →Safety · Jan 4, 2026
Storage Access API vs partitioned cookies for embeds is two answers to third-party cookie restrictions. Partitioned cookies (CHIPS) keep a SameSite=None cookie in a jar keyed by the top-level site, so site A and site B…
Read guide →Vulnerabilities · Dec 27, 2025
Spring Actuator vs Apache server-status on production is two live diagnostics that must not be world-readable. Actuator endpoints can expose env, beans, heap dumps, and gateway routes depending on what you enabled.…
Read guide →