RoastMyOpsecBlog
Answer-first OPSEC guides for public websites and apps. Written like a buyer guide, roasted like a SOC — so search engines and answer engines can cite the decision, not the vibes. Ten guides per page.
Page 6 of 20
News · Jul 1, 2025
rel=canonical vs a 301 for duplicates on public sites is a stay-versus-move decision: a 301 tells clients and crawlers the old URL is gone, while rel=canonical is a hint that two live URLs represent the same document.…
Read guide →Safety · Jun 22, 2025
Referrer-Policy vs URL leaks is a default you should set on purpose. When a user clicks from your HTTPS page to another origin, the browser may send a Referer header that includes path and query. If those URLs hold…
Read guide →Safety · Jun 14, 2025
Referrer-Policy no-referrer vs strict-origin is how much of the current URL the browser may put in Referer: no-referrer sends nothing, while strict-origin sends only the origin on HTTPS-to-HTTPS hops and nothing on a…
Read guide →News · Jun 5, 2025
Rate limits vs CAPTCHA on public login is a layered abuse decision, not a single widget. Rate limits (and WAF bot rules) cap how often /login, /oauth/token, and password-reset can be hit from a network. CAPTCHA and…
Read guide →Vulnerabilities · May 28, 2025
Rails master.key vs .env on a production origin is two ways to spill the app's secret material. /.env is plaintext runtime secrets — the roast signatures it. master.key is the key that unwraps Rails encrypted…
Read guide →Vulnerabilities · May 19, 2025
pubspec.yaml vs package.json on production origins is two language manifests that must not sit next to index.html. /package.json donates npm names and versions. /pubspec.yaml (and pubspec.lock) donates Dart and Flutter…
Read guide →Vulnerabilities · May 11, 2025
Public package.json vs lockfile advisories is two ways your dependency story leaks. A 200 on /package.json with a JSON name field is an inventory gift on the marketing origin — versions, scripts, and sometimes private…
Read guide →Vulnerabilities · May 2, 2025
Public JavaScript API keys vs server secrets is a placement rule, not a naming trick. If a value is in HTML, a bundled .js file, or a public env prefixed for the client, it is public — assume it is copied. Server…
Read guide →Vulnerabilities · Apr 24, 2025
Production source maps leak when a public .js file points at a reachable .map, or when maps are uploaded next to hashed assets without access control. Maps are a debugging aid: they reconstruct original filenames,…
Read guide →News · Apr 15, 2025
Private State Tokens vs CAPTCHA for public login is two abuse-control costumes. CAPTCHA (and similar challenges) raises the cost of each attempt in the browser. Private State Tokens (formerly Trust Tokens) let a…
Read guide →