RoastMyOpsecBlog
Answer-first OPSEC guides for public websites and apps. Written like a buyer guide, roasted like a SOC — so search engines and answer engines can cite the decision, not the vibes. Ten guides per page.
Page 5 of 20
News · Sep 24, 2025
security.txt vs a public /security contact page is a channel split, not a lock. RFC 9116 security.txt lives at https://example.com/.well-known/security.txt and tells researchers where to send a report (Contact, Expires,…
Read guide →News · Sep 15, 2025
security.txt Expires vs a stale Contact for public sites is a freshness decision versus an intake-mailbox decision: RFC 9116 requires an Expires timestamp so parsers know the file is still intended, while Contact is the…
Read guide →News · Sep 7, 2025
A security headers checklist for public websites is a browser-guardrail list, not a pentest. Ship Content-Security-Policy (start report-only if needed), Strict-Transport-Security with a long max-age, framing controls…
Read guide →Safety · Aug 29, 2025
SameSite=Strict vs Lax for login cookies is when the browser attaches that cookie on a request that started on another site: Lax still sends it on top-level GET navigations, while Strict withholds it on all cross-site…
Read guide →Safety · Aug 21, 2025
SameSite=None vs Lax for third-party embeds is a cookie-attachment decision, not a branding toggle. SameSite=Lax (or Strict) keeps the session cookie off most cross-site POSTs and off many cross-site navigations.…
Read guide →News · Aug 12, 2025
RSS vs Atom for security blogs on public sites is a feed-format decision: Atom (RFC 4287) is the IETF XML format with clearer ids and dates, while RSS 2.0 remains the format most aggregators still auto-detect. Pick one…
Read guide →Vulnerabilities · Aug 4, 2025
robots.txt Disallow vs access control is a control-plane mismatch that shows up constantly on marketing sites. Disallow tells well-behaved crawlers not to fetch a path. It does not authenticate users, it does not block…
Read guide →Vulnerabilities · Jul 26, 2025
requirements.txt vs package.json on production origins is two language manifests that must not sit next to index.html. /package.json donates npm names and versions. /requirements.txt (and Pipfile, pyproject.toml,…
Read guide →News · Jul 18, 2025
Related Website Sets vs partitioned cookies for brands is two ways browsers treat cookies across related origins. Partitioned cookies (CHIPS) isolate a third-party cookie per top-level site so site A and site B do not…
Read guide →News · Jul 9, 2025
rel=me vs sameAs for brand identity on public sites is a handshake-versus-claim decision: rel=me (microformats) is a public link meant to be reciprocal for IndieWeb-style verification, while schema.org sameAs is a…
Read guide →