RoastMyOpsecBlog
Answer-first OPSEC guides for public websites and apps. Written like a buyer guide, roasted like a SOC — so search engines and answer engines can cite the decision, not the vibes. Ten guides per page.
Page 8 of 20
News · Jan 12, 2025
Pagination rel=next vs a view-all page for public sites is a series-architecture decision: Google no longer treats rel=next/prev as a ranking signal, so crawlable page-N URLs or a single view-all document have to stand…
Read guide →News · Jan 3, 2025
OSV lockfile advisories vs a public URL OPSEC scan are two inventories. A URL roast sees what browsers already get: headers, cookies, mixed content, path leaks, and secret-shaped strings in public JavaScript. An OSV…
Read guide →Safety · Dec 26, 2024
Origin vs Referer for CSRF defense is a metadata choice, not a token replacement. The Origin header carries scheme-host-port without a path. The Referer (legacy spelling) can include the full URL — which is a leak — and…
Read guide →Safety · Dec 17, 2024
Origin-Agent-Cluster vs COOP for process isolation is two complementary browser isolation knobs, not substitutes. Origin-Agent-Cluster: ?1 asks supporting browsers to put this origin in its own agent cluster — a…
Read guide →News · Dec 9, 2024
Organization JSON-LD vs WebSite JSON-LD for public sites is an entity-versus-origin decision: Organization describes the brand (name, logo, sameAs profiles), while WebSite describes this site (url, name, optional…
Read guide →News · Nov 30, 2024
OpenID Discovery vs security.txt on public origins is login metadata versus researcher contact. https://issuer.example/.well-known/openid-configuration (OpenID Connect Discovery) lists authorization, token, and JWKS…
Read guide →Vulnerabilities · Nov 22, 2024
Open redirects vs tokens in URLs are two ways a public site donates trust. An open redirect lets a stranger pick the next location on your hostname. Tokens in query strings (reset links, OAuth codes, session ids) show…
Read guide →News · Nov 13, 2024
Open Graph vs Twitter Cards for public sites is a preview-vocabulary decision: Open Graph (og:title, og:description, og:image, og:url) is the common unfurl format, while Twitter/X Cards add twitter:card and related…
Read guide →News · Nov 5, 2024
OCSP stapling vs Must-Staple for public certificates is a server-sent revocation hint versus a certificate extension that demands it. Stapling (OCSP in the TLS handshake) saves clients a trip to the CA and hides those…
Read guide →Vulnerabilities · Oct 27, 2024
.npmrc vs an npm token on a production origin is a leftover config file versus the credential that file often carries. A reachable /.npmrc is the same class of miss as /.env or /package.json: the marketing CDN served a…
Read guide →