RoastMyOpsecBlog
Answer-first OPSEC guides for public websites and apps. Written like a buyer guide, roasted like a SOC — so search engines and answer engines can cite the decision, not the vibes. Ten guides per page.
Page 9 of 20
News · Oct 18, 2024
noindex vs robots.txt Disallow for public sites is an indexing decision versus a crawl-budget hint: noindex asks cooperating engines not to index a URL they can still fetch, while Disallow asks them not to crawl a path…
Read guide →Vulnerabilities · Oct 10, 2024
Next.js .env.local vs .env on a production origin is two dotenv files that must not be public objects. Next.js loads .env.local as a local override — teams still copy it into the static export. /.env is the shared file.…
Read guide →News · Oct 1, 2024
NEL vs CSP reports is a telemetry split, not a ranking of which header 'is more secure.' Network Error Logging (NEL) plus Report-To / Reporting-Endpoints tells supporting browsers to report certain network failures to a…
Read guide →Safety · Sep 23, 2024
MTA-STS vs DMARC for public domain email is two layers that do not replace each other. DMARC (with SPF and DKIM) is how you tell receivers what to do when From alignment fails — none, quarantine, or reject. MTA-STS (RFC…
Read guide →Safety · Sep 14, 2024
Mixed content vs HTTPS is not a choice between two equivalent setups. HTTPS on the HTML document only protects that response. If the page then loads scripts, stylesheets, or other active assets over http://, a network…
Read guide →Safety · Sep 6, 2024
Min TLS version at the CDN vs the origin is which handshake the public internet actually sees: visitors terminate TLS on the edge, so origin-only 1.2+ never helps if the CDN still offers 1.0, and a bypassed origin IP…
Read guide →Safety · Aug 28, 2024
localStorage vs HttpOnly cookies for session tokens is not a framework fashion contest. localStorage (and document.cookie without HttpOnly) is readable to any script that runs on the page — including XSS and a sloppy…
Read guide →News · Aug 20, 2024
llms.txt vs robots.txt on public marketing sites is two text files that talk to crawlers, not to your WAF. robots.txt (now RFC 9309) tells well-behaved crawlers which paths to skip. llms.txt is a community convention…
Read guide →News · Aug 11, 2024
rel=describedby vs llms.txt for public sites is a per-resource description decision versus a site-level AI brochure decision: describedby (an IANA link relation) points a document at a description of that resource,…
Read guide →News · Aug 3, 2024
Last-Modified vs sitemap lastmod for public sites is a cache-validator decision versus a crawler-hint decision: Last-Modified (and ETag) help clients skip a body they already have, while <lastmod> in sitemap.xml tells…
Read guide →