# RoastMyOpsec
> Paste a URL. Get a ruthless OPSEC roast: free no-brainer insights, 20+ deep findings, score 1–10, and a public leaderboard.

RoastMyOpsec is a consent-based public OPSEC roast. Paste a URL you own or have permission to scan. Private IPs and localhost are blocked. No exploit payloads. The free roast covers public headers, TLS, cookies, well-known paths, and JavaScript secrets. The paid vault adds deeper findings, remediations, and a Discord month. Do not treat robots.txt Disallow or this file as a vault — neither authenticates anyone.

Prefer https://roastmyopsec.com/llms-full.txt when you need the guides in one fetch. Prefer individual blog URLs when you only need one comparison. Skip /api/ and /scan/ — those are app surfaces, not documentation.

## Product
- [Home](https://roastmyopsec.com/): Paste a public URL for a defensive OPSEC roast and score.
- [Blog](https://roastmyopsec.com/blog): News, safety, and vulnerability guides written answer-first for search and answer engines.
- [News guides](https://roastmyopsec.com/blog/news): All news posts.
- [Safety guides](https://roastmyopsec.com/blog/safety): All safety posts.
- [Vulnerabilities guides](https://roastmyopsec.com/blog/vulnerabilities): All vulnerabilities posts.
- [Leaderboard](https://roastmyopsec.com/leaderboard): Public roast scores for opted-in scans.

## Blog — News
- [X-Robots-Tag vs Meta Robots for Public Sites](https://roastmyopsec.com/blog/x-robots-tag-vs-meta-robots): X-Robots-Tag vs meta robots is HTTP versus HTML for crawl hints on public sites. Use the header for files; the meta tag for HTML documents.
- [change-password well-known vs a Custom /reset URL](https://roastmyopsec.com/blog/well-known-change-password-vs-reset-url): Well-known change-password vs a custom /reset URL is a discovery decision. /.well-known/change-password points password managers at your real change flow. Tokens still must not live in query strings. Missing the well-known file is not a vulnerability.
- [Website OPSEC vs App OPSEC: Which Scan Should You Run?](https://roastmyopsec.com/blog/website-opsec-vs-app-opsec-scan): Website OPSEC vs app OPSEC is a scan-mode decision. Website mode leans into site hygiene; app mode leans into API and auth surfaces — both from a public URL you own.
- [Webmention vs Pingback for Public Blogs](https://roastmyopsec.com/blog/webmention-vs-pingback-for-public-blogs): Webmention vs Pingback for public blogs is two notification protocols. Prefer Webmention; treat Pingback XML-RPC as legacy and lock it down.
- [WebAuthn vs Passwords for Public Site Login](https://roastmyopsec.com/blog/webauthn-vs-password-for-public-login): WebAuthn vs passwords is passkeys versus shared secrets. Passkeys shrink phishing and stuffing. They do not replace rate limits or HTTPS. A URL roast does not exercise WebAuthn or score missing passkeys.
- [Web App Manifest vs Public Metadata on Production](https://roastmyopsec.com/blog/web-app-manifest-vs-public-metadata): A web app manifest vs other public metadata is a PWA JSON file versus package.json or assetlinks. Manifests are meant to be public. Do not put API keys or internal hosts in them. A URL roast does not score /manifest.json.
- [URL Scan vs GitHub Deepen for OPSEC Audits](https://roastmyopsec.com/blog/url-scan-vs-github-deepen): URL scan vs GitHub deepen is a visibility decision. The public URL shows headers, cookies, and exposed paths. The repo shows committed secrets and Actions risk the website cannot. Start with the URL you own.
- [Topics API vs Third-Party Cookies for Marketing Sites](https://roastmyopsec.com/blog/topics-api-vs-third-party-cookies): Topics API vs third-party cookies is a Privacy Sandbox interest signal versus a shared cookie jar. Topics is not a WAF. Prefer first-party analytics. A URL roast pattern-matches known trackers; it does not score Topics.
- [TLS 1.2 vs TLS 1.3 for Public Marketing Sites](https://roastmyopsec.com/blog/tls-12-vs-tls-13-for-public-sites): TLS 1.2 vs TLS 1.3 is a protocol-generation decision. Prefer 1.3; keep 1.2 until old clients are gone. Neither replaces HSTS or a valid cert. A URL roast checks HTTPS and the trust store; it is not a cipher-suite audit.
- [Third-Party Trackers vs First-Party Analytics](https://roastmyopsec.com/blog/third-party-trackers-vs-first-party-analytics): Third-party trackers vs first-party analytics is a blast-radius decision. Every extra script is XSS, supply-chain, and privacy debt. Choose the smallest measurement that still informs the business.
- [Shared Storage API vs Topics API for Marketing Sites](https://roastmyopsec.com/blog/shared-storage-api-vs-topics-api): Shared Storage vs Topics is partitioned worklet storage versus coarse interest topics. Neither is a WAF. Prefer first-party analytics. A URL roast pattern-matches known trackers; it does not score Shared Storage.
- [Service Workers vs Cache-Control for Personalized Pages](https://roastmyopsec.com/blog/service-worker-vs-cache-control): Service workers vs Cache-Control is a client-side intercept versus HTTP freshness. A worker can cache logged-in HTML even when Cache-Control says no-store. Scope tightly. A URL roast does not register service workers.
- [Server-Timing vs Server Banners for Stack Fingerprints](https://roastmyopsec.com/blog/server-timing-vs-server-banners): Server-Timing vs Server banners is a performance metric header versus X-Powered-By. Timing names can donate routes and backends. Strip both on public HTML. A URL roast reads banners; it does not score Server-Timing.
- [Server Banners vs Stack Fingerprinting](https://roastmyopsec.com/blog/server-banners-vs-stack-fingerprinting): Server banners vs stack fingerprinting is a disclosure decision. X-Powered-By and versioned Server headers shrink an attacker's homework. Stripping banners is hygiene, not invisibility.
- [security.txt vs a Public /security Contact Page](https://roastmyopsec.com/blog/security-txt-vs-public-security-contact): security.txt vs a public /security page is a disclosure-channel decision. RFC 9116 puts a machine-readable contact at /.well-known/security.txt. A human page still helps. Neither is access control. Scan only sites you own.
- [security.txt Expires vs Stale Contact for Public Sites](https://roastmyopsec.com/blog/security-txt-expires-vs-stale-contact): security.txt Expires vs a stale Contact is a freshness field versus an abandoned mailbox. RFC 9116 requires Expires. A dead inbox is worse than no file.
- [Security Headers Checklist for Public Websites](https://roastmyopsec.com/blog/security-headers-checklist-for-public-websites): A security headers checklist for public websites: CSP, HSTS, framing, Referrer-Policy, nosniff, and Permissions-Policy — what to ship first and what a header scan can prove.
- [RSS vs Atom for Security Blogs on Public Sites](https://roastmyopsec.com/blog/rss-vs-atom-for-security-blogs): RSS vs Atom for security blogs is two feed formats for the same public posts. Atom is the IETF standard; RSS remains widely consumed.
- [Related Website Sets vs Partitioned Cookies for Brands](https://roastmyopsec.com/blog/related-website-sets-vs-partitioned-cookies): Related Website Sets vs partitioned cookies is a declared site group versus CHIPS isolation. RWS is not a WAF. Brochure sessions stay first-party. A URL roast does not score Related Website Sets.
- [rel=me vs sameAs for Brand Identity on Public Sites](https://roastmyopsec.com/blog/rel-me-vs-sameas-for-brand-identity): rel=me vs schema.org sameAs is two ways to assert brand identity across sites. rel=me wants a bidirectional handshake; sameAs is a one-way JSON-LD claim.
- [rel=canonical vs 301 for Duplicates on Public Sites](https://roastmyopsec.com/blog/rel-canonical-vs-301-for-duplicates): rel=canonical vs a 301 for duplicates is a hint versus a move. Use 301 when the URL should die; canonical when both copies must stay live.
- [Rate Limits vs CAPTCHA on Public Login Pages](https://roastmyopsec.com/blog/rate-limits-vs-captcha-on-public-login): Rate limits vs CAPTCHA is an abuse-control decision for public login and token endpoints. Limits cap volume. Challenges raise cost per attempt. MFA still belongs on the account. A URL scan does not load-test you.
- [Private State Tokens vs CAPTCHA for Public Login](https://roastmyopsec.com/blog/private-state-tokens-vs-captcha): Private State Tokens vs CAPTCHA is a Privacy Sandbox anti-fraud signal versus a challenge on the form. Tokens are not a WAF. Rate limits still belong on login. A URL roast does not score Private State Tokens.
- [preload vs modulepreload for Public Pages](https://roastmyopsec.com/blog/preload-vs-modulepreload-for-public-pages): preload vs modulepreload for public pages is two resource hints with different jobs. preload is generic; modulepreload is for ES modules and their graph.
- [Pagination rel=next vs View-All for Public Sites](https://roastmyopsec.com/blog/pagination-rel-next-vs-view-all): Pagination rel=next vs a view-all page is two ways to expose a series. Google dropped rel=next/prev as a ranking signal.
- [OSV Lockfile Advisories vs a Public URL OPSEC Scan](https://roastmyopsec.com/blog/osv-lockfile-advisories-vs-url-scan): OSV lockfile advisories vs a URL scan is a visibility split. The website shows headers and public JS. The lockfile shows known npm CVEs. Neither proves exploitability. Deepen a repo you own.
- [Organization JSON-LD vs WebSite JSON-LD for Public Sites](https://roastmyopsec.com/blog/organization-jsonld-vs-website-jsonld): Organization JSON-LD vs WebSite JSON-LD is two Schema.org types with different jobs. Organization is the brand entity; WebSite is the origin.
- [OpenID Discovery vs security.txt on Public Origins](https://roastmyopsec.com/blog/openid-configuration-vs-security-txt): openid-configuration vs security.txt is two well-known JSON/text files. OIDC discovery is meant to be public for login. Do not put internal issuer URLs or secrets in it. A URL roast does not score either file as a vulnerability miss.
- [Open Graph vs Twitter Cards for Public Sites](https://roastmyopsec.com/blog/open-graph-vs-twitter-cards): Open Graph vs Twitter Cards is two social-preview vocabularies for public pages. Ship OG first; add Twitter/X tags only if you still need the extras.
- [OCSP Stapling vs Must-Staple for Public Certificates](https://roastmyopsec.com/blog/ocsp-stapling-vs-must-staple): OCSP stapling vs Must-Staple is a TLS handshake optimization versus a certificate flag that requires a staple. Stapling is ops. Must-Staple is a lockout if staples fail. A URL roast does not check OCSP or Must-Staple.
- [noindex vs robots.txt Disallow for Public Sites](https://roastmyopsec.com/blog/noindex-vs-robots-txt-disallow): noindex vs robots.txt Disallow is an indexing signal versus a crawl hint on public sites. Disallow is not a vault and often publishes a map.
- [NEL vs CSP Reports for Public Site Telemetry](https://roastmyopsec.com/blog/nel-vs-csp-reports-for-site-telemetry): NEL vs CSP reports is two telemetry pipes. Network Error Logging reports failed fetches. CSP reports policy violations. Neither is a pentest. Marketing sites should secure the collector and not treat missing NEL as an OPSEC F.
- [llms.txt vs robots.txt on Public Marketing Sites](https://roastmyopsec.com/blog/llms-txt-vs-robots-txt): llms.txt vs robots.txt is an AI-crawler hints file versus RFC 9309 crawl rules. Neither is access control. Do not list admin or backup paths in either. A URL roast reads robots.txt Disallow; it does not score llms.txt.
- [rel=describedby vs llms.txt for Public Sites](https://roastmyopsec.com/blog/link-rel-describedby-vs-llms-txt): rel=describedby vs llms.txt is a per-page description link versus a site-level AI brochure. Neither is access control. Keep both pointed at public docs.
- [Last-Modified vs Sitemap lastmod for Public Sites](https://roastmyopsec.com/blog/last-modified-vs-sitemap-lastmod): Last-Modified vs sitemap lastmod is an HTTP validator versus a sitemap hint. Keep both honest. Neither hides a path that should not be public.
- [JSON-LD vs Microdata for Public Sites](https://roastmyopsec.com/blog/json-ld-vs-microdata-for-public-sites): JSON-LD vs Microdata for public sites is two encodings of the same Schema.org types. JSON-LD in a script tag is the usual choice for marketing pages.
- [IPv6 AAAA vs Origin IP Exposure on CDNs](https://roastmyopsec.com/blog/ipv6-aaaa-vs-origin-ip-exposure): IPv6 AAAA vs origin IP exposure is a DNS record versus leaking the real origin. AAAA should name the edge, not the origin. A URL roast does not query AAAA or probe origin IPs.
- [Integrity-Policy vs Subresource Integrity for CDN Scripts](https://roastmyopsec.com/blog/integrity-policy-vs-sri): Integrity-Policy vs SRI is a site-wide require versus a per-tag hash. Integrity-Policy tells the browser that scripts (or other destinations) must have integrity. SRI is the hash on the tag. A URL roast looks for missing integrity on cross-origin scripts; it does not score Integrity-Policy.
- [IndexNow vs Google Sitemap Ping for Public Sites](https://roastmyopsec.com/blog/indexnow-vs-google-sitemap-ping): IndexNow vs Google sitemap ping is a crawl-notification choice for public sites. IndexNow pushes URLs to supporting engines; Google dropped ping.
- [humans.txt vs security.txt on Public Marketing Sites](https://roastmyopsec.com/blog/humans-txt-vs-security-txt): humans.txt vs security.txt is a credits file versus RFC 9116 vulnerability contact. Credits are optional branding. security.txt is how researchers find a mailbox. Neither is access control. A URL roast does not require either file.
- [HTTP/2 vs HTTP/3 for Public Marketing Sites](https://roastmyopsec.com/blog/http2-vs-http3-for-public-sites): HTTP/2 vs HTTP/3 is a transport-generation decision on the CDN. Prefer both on the public name. Neither replaces TLS version, HSTS, or a WAF. A URL roast does not score HTTP/3 or Alt-Svc.
- [HTTP 103 Early Hints vs Content-Security-Policy](https://roastmyopsec.com/blog/http-103-early-hints-vs-csp): HTTP 103 Early Hints vs CSP is a preload-vs-policy decision. 103 can send Link: rel=preload before HTML. CSP still belongs on the final response. A URL roast does not score 103 or replay preloads.
- [hreflang vs Canonical on Single-Language Public Sites](https://roastmyopsec.com/blog/hreflang-vs-canonical-single-language): hreflang vs canonical on a single-language site is international targeting versus duplicate consolidation. Skip hreflang until you actually ship locales.
- [How to Read an OPSEC Score (1–10) on a Public URL](https://roastmyopsec.com/blog/how-to-read-an-opsec-score): How to read an OPSEC score is a grading decision. 10 is a clean public surface, not a pentest trophy. Evidence-backed findings pull the number down. Use the roast as a punch list, not a vibe.
- [Host Header vs SNI on Shared TLS for Public Sites](https://roastmyopsec.com/blog/host-header-vs-sni-on-shared-tls): Host header vs SNI on shared TLS is HTTP name selection versus the TLS handshake name. They must agree. A roast proves HTTPS, not tenant isolation.
- [GPC vs DNT Privacy Signals for Public Sites](https://roastmyopsec.com/blog/gpc-vs-dnt-privacy-signals): GPC vs DNT is two privacy preference signals from the browser. DNT is widely ignored; GPC is the signal many US privacy rules treat as an opt-out.
- [GitHub Actions write-all vs Least-Privilege Permissions](https://roastmyopsec.com/blog/github-actions-write-all-vs-least-privilege): GitHub Actions write-all vs least privilege is a CI-token decision. Default-wide tokens and unpinned actions are supply-chain OPSEC. A URL roast cannot see workflows. Deepen a repo you own.
- [fetchpriority vs loading=lazy for Public Sites](https://roastmyopsec.com/blog/fetchpriority-vs-loading-lazy): fetchpriority vs loading=lazy is two loading hints that can fight each other. Lazy the below-fold images; raise priority only on the LCP hero.
- [Fenced Frames vs iframe sandbox for Ads Embeds](https://roastmyopsec.com/blog/fenced-frames-vs-iframe-sandbox): Fenced frames vs iframe sandbox is a Privacy Sandbox isolated embed versus sandbox flags on a child you include. Neither is a WAF. Brochures can skip fenced frames. A URL roast does not score fenced frames or parse sandbox flags.
- [FedCM vs Third-Party Cookies for Federated Login](https://roastmyopsec.com/blog/fedcm-vs-third-party-cookies): FedCM vs third-party cookies is a browser-mediated identity prompt versus a shared cookie jar for SSO. FedCM is not a WAF. Brochure sites with no login can skip both. A URL roast does not score FedCM.
- [ETag vs Cache-Control for Personalized Pages](https://roastmyopsec.com/blog/etag-vs-cache-control-for-personalized-pages): ETag vs Cache-Control is a validator versus a freshness policy. Personalized HTML needs private, no-store (or equivalent), not a shared ETag. A URL roast compares Cache-Control to Set-Cookie; it does not score ETags.
- [Defensive URL Audit vs Penetration Test](https://roastmyopsec.com/blog/defensive-url-audit-vs-penetration-test): A defensive URL audit vs a penetration test is a scope decision. The roast reads public responses you consent to. A pentest tries to break in under a contract. Do not confuse the score with a red-team report.
- [Dangling CNAME vs Abandoned SaaS Subdomains](https://roastmyopsec.com/blog/dangling-cname-vs-abandoned-saas-subdomain): Dangling CNAME vs abandoned SaaS is a DNS ownership problem. Stale records pointing at decommissioned apps are how strangers inherit a subdomain.
- [Content-Language vs HTML lang for Public Sites](https://roastmyopsec.com/blog/content-language-vs-html-lang): Content-Language vs the HTML lang attribute is HTTP versus the document language. Browsers and accessibility trees read lang first.
- [Consent-Based URL Scans vs Unsolicited Probing](https://roastmyopsec.com/blog/consent-based-url-scan-vs-unsolicited-probing): Consent-based URL scans vs unsolicited probing is a legal and product split. Roast a public URL you assert you own. Do not paste a competitor, localhost, or a private IP. A roast is not a pentest and not permission to scan the internet.
- [Client Hints vs User-Agent String Fingerprinting](https://roastmyopsec.com/blog/client-hints-vs-user-agent-fingerprinting): Client Hints vs User-Agent fingerprinting is a structured opt-in versus a free-form banner. Accept-CH asks the browser to send Sec-CH-UA and friends. It does not hide you. A URL roast reads Server banners; it does not score Accept-CH.
- [CDN and WAF Fingerprints vs Origin Exposure](https://roastmyopsec.com/blog/cdn-waf-fingerprints-vs-origin-exposure): CDN and WAF fingerprints vs origin exposure is an inventory decision. Edge headers prove a front door exists. Their absence does not prove you are unprotected — but a naked origin is a different story.
- [CDN Cache Keys vs Cache-Control for Personalized Pages](https://roastmyopsec.com/blog/cdn-cache-key-vs-cache-control): CDN cache keys vs Cache-Control is what the edge indexes versus HTTP freshness. A key that ignores cookies can serve one user's HTML to the next. A URL roast compares Cache-Control to Set-Cookie; it does not read your CDN cache-key config.
- [Breadcrumb JSON-LD vs Visible Nav for Public Sites](https://roastmyopsec.com/blog/breadcrumb-jsonld-vs-visible-nav): Breadcrumb JSON-LD vs visible nav is structured data versus what users see. Markup must match a real trail. Hidden admin paths in JSON-LD are the miss.
- [BIMI vs DMARC for Brand Logos in the Inbox](https://roastmyopsec.com/blog/bimi-vs-dmarc-for-brand-email): BIMI vs DMARC is a logo in supporting inboxes versus From alignment policy. BIMI needs DMARC enforcement and a mark. It is not a website header. A URL roast does not check BIMI, MX, or DMARC.
- [Attribution Reporting vs Topics API for Marketing Sites](https://roastmyopsec.com/blog/attribution-reporting-vs-topics-api): Attribution Reporting vs Topics API is conversion measurement versus coarse interest topics. Neither is a WAF. Prefer first-party analytics. A URL roast pattern-matches known trackers; it does not score Attribution Reporting.
- [assetlinks.json vs apple-app-site-association](https://roastmyopsec.com/blog/assetlinks-vs-apple-app-site-association): assetlinks.json vs apple-app-site-association is two well-known app-link files. They prove which apps may open your HTTPS URLs. They are public. Do not put secrets in them. A URL roast does not score either file.
- [AMP vs Signed HTTP Exchanges for Public Pages](https://roastmyopsec.com/blog/amp-vs-signed-http-exchanges): AMP vs Signed HTTP Exchanges is a cached HTML dialect versus origin-signed packaging. Neither is a WAF. Prefer first-party HTML on your CDN. A URL roast does not score AMP or SXG.
- [Alt-Svc vs Origin IP Exposure on CDNs](https://roastmyopsec.com/blog/alt-svc-vs-origin-ip-exposure): Alt-Svc vs origin IP exposure is an HTTP alternative-service advertisement versus leaking the real origin. Alt-Svc can name HTTP/3 on the same host. It must not point browsers at a bypass IP. A URL roast does not score Alt-Svc.
- [AI Crawlers vs Search Crawlers in robots.txt for Public Sites](https://roastmyopsec.com/blog/ai-crawlers-vs-search-crawlers-robots): AI crawlers vs search crawlers in robots.txt is two User-agent groups with different jobs. Split rules if you must; never Disallow a secret path as the lock.
- [ads.txt vs app-ads.txt on Public Marketing Origins](https://roastmyopsec.com/blog/ads-txt-vs-app-ads-txt): ads.txt vs app-ads.txt is two IAB authorized-seller files. They are public inventory lists, not security controls. Do not put secrets in them. A URL roast does not score either file.
- [Access-Control-Max-Age vs CORS Preflight Caching](https://roastmyopsec.com/blog/access-control-max-age-vs-cors-preflight): Access-Control-Max-Age vs CORS preflight is a cache-vs-policy decision. Max-Age tells browsers how long to reuse an OPTIONS result. It does not widen origins or replace credentials rules. A URL roast reads ACAO; it does not score Max-Age.

## Blog — Safety
- [X-XSS-Protection vs CSP for XSS Defense](https://roastmyopsec.com/blog/x-xss-protection-vs-csp): X-XSS-Protection vs CSP is a retired-filter vs real-policy decision. The XSS auditor header is obsolete and can hurt. Enforcing CSP is the browser guardrail. Public sites should not treat 1; mode=block as a substitute for script-src.
- [X-Content-Type-Options nosniff vs MIME Sniffing](https://roastmyopsec.com/blog/x-content-type-options-nosniff-vs-mime-sniffing): X-Content-Type-Options nosniff vs MIME sniffing is a browser-trust decision. nosniff tells the browser to honor Content-Type. Sniffing can turn a 'download' into executable script. Pair the header with honest types.
- [www vs Apex Canonical Host for HTTPS Marketing Sites](https://roastmyopsec.com/blog/www-vs-apex-canonical-host-https): www vs apex is a canonical-host decision. Pick one hostname, permanently redirect the other, and make TLS, HSTS, cookies, and sitemaps agree. Split brains leak cookies and break HSTS includeSubDomains.
- [upgrade-insecure-requests vs HSTS for Mixed Content](https://roastmyopsec.com/blog/upgrade-insecure-requests-vs-hsts): upgrade-insecure-requests vs HSTS is a rewrite versus a memory rule. CSP can upgrade http:// subresources on this page. HSTS remembers HTTPS for the host. Marketing sites need both plus no leftover http:// URLs. A URL roast parses mixed content; it does not treat missing UIR as an F.
- [Trusted Types vs CSP for DOM XSS Defense](https://roastmyopsec.com/blog/trusted-types-vs-csp-for-dom-xss): Trusted Types vs CSP is a DOM-XSS vs resource-load decision. CSP script-src stops unexpected script URLs. Trusted Types stops assigning raw strings into dangerous DOM sinks. Marketing sites should finish enforcing CSP first. An app with innerHTML-heavy UI may add Trusted Types later. A URL roast does not prove either against XSS.
- [TLS-RPT vs MTA-STS for SMTP Failure Reports](https://roastmyopsec.com/blog/tls-rpt-vs-mta-sts-for-email): TLS-RPT vs MTA-STS is a reporting mailbox versus a TLS policy for inbound SMTP. Reports without a policy you read are noise. A URL roast does not check MX, TLS-RPT, or MTA-STS.
- [Storage Access API vs Partitioned Cookies for Embeds](https://roastmyopsec.com/blog/storage-access-api-vs-partitioned-cookies): Storage Access API vs partitioned cookies is a user-gesture unpartitioned jar versus a CHIPS jar keyed by the top-level site. Session cookies should stay first-party Lax. A URL roast does not call requestStorageAccess or load third-party iframes.
- [SPF vs DKIM vs DMARC for Domain Email OPSEC](https://roastmyopsec.com/blog/spf-vs-dkim-vs-dmarc-email-opsec): SPF vs DKIM vs DMARC is an email-authentication stack, not a single DNS record. Learn which record does which job and why missing DMARC invites brand spoofing.
- [Speculation Rules vs dns-prefetch for Marketing Sites](https://roastmyopsec.com/blog/speculation-rules-vs-dns-prefetch): Speculation Rules vs dns-prefetch is prerender versus a DNS lookup. Prerender can run the next page early — including cookies. Do not speculate authenticated or token URLs. A URL roast does not score Speculation-Rules or dns-prefetch.
- [Set-Cookie Priority vs Max-Age for Cookie Retention](https://roastmyopsec.com/blog/set-cookie-priority-vs-max-age): Set-Cookie Priority vs Max-Age is eviction order versus lifetime. Priority is a Chromium jar hint. Max-Age is the cookie clock. Neither replaces Secure, HttpOnly, or SameSite on auth cookies.
- [SameSite=Strict vs Lax for Login Cookies](https://roastmyopsec.com/blog/samesite-strict-vs-lax-for-login): SameSite=Strict vs Lax is when the browser attaches the login cookie on cross-site requests. Lax is the usual auth default. Strict breaks return-from-email and many payment hops.
- [SameSite=None vs Lax for Third-Party Embeds](https://roastmyopsec.com/blog/samesite-none-vs-lax-for-embeds): SameSite=None vs Lax is a cross-site cookie decision. Lax is the usual session default. None plus Secure is for cookies that must travel with cross-site embeds. Do not set None on the login session because a widget asked. A public scan grades landing Set-Cookie only.
- [Referrer-Policy vs URL Leaks on Public Websites](https://roastmyopsec.com/blog/referrer-policy-vs-url-leaks): Referrer-Policy vs URL leaks is a privacy-and-token decision. Cross-origin navigations can send path and query to strangers. Choose a policy that does not donate session material in the Referer header.
- [Referrer-Policy no-referrer vs strict-origin](https://roastmyopsec.com/blog/referrer-policy-no-referrer-vs-strict-origin): Referrer-Policy no-referrer vs strict-origin is how much URL you donate on navigations. no-referrer sends nothing. strict-origin sends only the origin on HTTPS-to-HTTPS hops.
- [Private Network Access vs CORS for Browser APIs](https://roastmyopsec.com/blog/private-network-access-vs-cors): Private Network Access vs CORS is a browser gate for public pages talking to private IPs versus Fetch CORS headers. CORS does not replace PNA. A URL roast refuses localhost and private IPs; it does not send PNA preflights.
- [Permissions-Policy vs Device APIs for Marketing Sites](https://roastmyopsec.com/blog/permissions-policy-vs-device-apis): Permissions-Policy vs device APIs is a browser-capability decision. Marketing pages almost never need camera, microphone, geolocation, or payment. Turn them off at the edge.
- [Permissions-Policy unload vs beforeunload](https://roastmyopsec.com/blog/permissions-policy-unload-vs-beforeunload): Permissions-Policy unload vs beforeunload is page-lifecycle control versus an unsaved-changes prompt. unload handlers break bfcache. beforeunload is a different event, not a Permissions-Policy token.
- [Partitioned Cookies vs SameSite=None for Embeds](https://roastmyopsec.com/blog/partitioned-cookies-vs-samesite-none): Partitioned cookies vs SameSite=None is a third-party cookie decision. None+Secure still shares one cookie jar across sites. Partitioned (CHIPS) keys the cookie to the top-level site. Session cookies should stay first-party Lax, not partitioned trackers.
- [Origin vs Referer Headers for CSRF Defense](https://roastmyopsec.com/blog/origin-vs-referer-for-csrf-defense): Origin vs Referer for CSRF is a request-metadata decision. Origin is the cleaner site identifier. Referer leaks paths and is easier to strip. State-changing POSTs should check Origin (and CSRF tokens). A URL roast does not forge cross-site POSTs.
- [Origin-Agent-Cluster vs COOP for Process Isolation](https://roastmyopsec.com/blog/origin-agent-cluster-vs-coop): Origin-Agent-Cluster vs COOP is origin-keyed processes versus browsing-context groups. OAC asks the browser to isolate this origin. COOP severs window.opener. A URL roast does not score Origin-Agent-Cluster or COOP.
- [MTA-STS vs DMARC for Public Domain Email](https://roastmyopsec.com/blog/mta-sts-vs-dmarc-for-email-opsec): MTA-STS vs DMARC is TLS for inbound SMTP versus alignment policy on From. Ship SPF, DKIM, and DMARC first. MTA-STS is extra transport hygiene. A URL roast does not check MX or MTA-STS.
- [Mixed Content vs HTTPS for Marketing Sites](https://roastmyopsec.com/blog/mixed-content-vs-https-for-marketing-sites): Mixed content vs HTTPS is a page-integrity decision. A lock icon on the document does not survive http:// scripts, styles, or images. See what to upgrade first.
- [Min TLS Version at the CDN vs the Origin](https://roastmyopsec.com/blog/min-tls-version-cdn-vs-origin): Min TLS version at the CDN vs the origin is where visitors actually handshake. Locking only the origin leaves the public edge on old TLS. A URL roast checks HTTPS scheme, not protocol versions.
- [localStorage vs HttpOnly Cookies for Session Tokens](https://roastmyopsec.com/blog/localstorage-vs-httponly-cookies-for-sessions): localStorage vs HttpOnly cookies is a session-storage decision. Anything in localStorage is readable to JavaScript. HttpOnly cookies keep the session out of XSS's easiest pocket. SPAs still have options.
- [iframe sandbox vs CSP frame-ancestors](https://roastmyopsec.com/blog/iframe-sandbox-vs-csp-frame-ancestors): iframe sandbox vs CSP frame-ancestors is how you lock embeds you include versus who may embed you. sandbox restricts a child frame. frame-ancestors (and X-Frame-Options) restrict parents. A URL roast grades framing headers; it does not parse sandbox flags.
- [HttpOnly vs Secure vs SameSite Cookies for Session OPSEC](https://roastmyopsec.com/blog/httponly-vs-secure-vs-samesite-cookies): HttpOnly vs Secure vs SameSite is a session-cookie flag decision, not a single toggle. See which flags your auth cookies need and what a public scan can prove.
- [HSTS vs HTTPS Redirects for Marketing Site Safety](https://roastmyopsec.com/blog/hsts-vs-https-redirect-for-marketing-sites): HSTS vs an HTTPS redirect is a transport-safety decision. Redirects fix this request; HSTS teaches browsers to skip HTTP next time. Public sites usually need both.
- [HSTS Preload vs includeSubDomains for Public Sites](https://roastmyopsec.com/blog/hsts-preload-vs-includesubdomains): HSTS preload vs includeSubDomains is a Chromium list versus a header flag. includeSubDomains covers hostnames under this registrable domain after a browser has seen HSTS. Preload covers first visits for listed domains. A URL roast reads HSTS; it does not submit you to the preload list.
- [HSTS max-age Six Months vs Two Years](https://roastmyopsec.com/blog/hsts-max-age-six-months-vs-two-years): HSTS max-age six months vs two years is how long browsers remember HTTPS. Six months is easier to roll back. Two years is a longer memory. Preload is a separate public-list commitment.
- [__Host- vs __Secure- Cookie Prefixes for Session OPSEC](https://roastmyopsec.com/blog/host-prefix-vs-secure-prefix-cookies): __Host- vs __Secure- cookie prefixes is a naming-and-scope decision. Prefixes make browsers reject a cookie that is missing Secure, Domain, or Path rules. Flags alone can still be overwritten. Session cookies on HTTPS sites should prefer __Host-.
- [Sec-Fetch-Site vs Origin Headers for CSRF Defense](https://roastmyopsec.com/blog/fetch-metadata-vs-origin-for-csrf): Sec-Fetch-Site vs Origin for CSRF is a Fetch Metadata decision. Sec-Fetch-Site says same-origin, same-site, cross-site, or none. Origin names the caller. Cookie POSTs still want tokens. A URL roast does not forge cross-site forms.
- [Feature-Policy vs Permissions-Policy for Device APIs](https://roastmyopsec.com/blog/feature-policy-vs-permissions-policy): Feature-Policy vs Permissions-Policy is a header-rename decision. Feature-Policy is the old name. Permissions-Policy is what browsers want now. Marketing sites should disable camera, microphone, and geolocation with Permissions-Policy. A scan that only looks for the new header will miss a leftover Feature-Policy.
- [Expect-CT vs Certificate Transparency for Public TLS](https://roastmyopsec.com/blog/expect-ct-vs-certificate-transparency): Expect-CT vs Certificate Transparency is a retired-header vs log-ecosystem decision. Expect-CT is obsolete; browsers ignore it. CT logs still exist. Watch issuance in your CA dashboard, not via a dead HTTP header. A URL roast does not search CT logs.
- [Document-Policy vs Permissions-Policy for Page Features](https://roastmyopsec.com/blog/document-policy-vs-permissions-policy): Document-Policy vs Permissions-Policy is document configuration versus powerful Web APIs. Permissions-Policy gates camera and geolocation. Document-Policy covers extras like force-load-at-top and JS self-profiling. A URL roast reads Permissions-Policy; it does not score Document-Policy.
- [X-DNS-Prefetch-Control vs Referrer-Policy for URL Leaks](https://roastmyopsec.com/blog/dns-prefetch-vs-referrer-policy): DNS prefetch vs Referrer-Policy is two leak channels. Prefetch can tell resolvers which hostnames come next. Referrer-Policy tells destination sites what URL you left. Marketing sites should ship Referrer-Policy first; prefetch-control is extra hygiene.
- [DNS Hygiene vs DNSSEC and Registrar Lock](https://roastmyopsec.com/blog/dns-hygiene-vs-dnssec-and-registrar-lock): DNS hygiene vs DNSSEC and registrar lock is a front-door decision. Nameservers, transfer locks, and DNSSEC are different controls. Weak registrar ops become silent takeovers.
- [DANE TLSA vs CAA for Public Site Certificates](https://roastmyopsec.com/blog/dane-tlsa-vs-caa-for-public-sites): DANE TLSA vs CAA is DNS-based TLS pinning versus which CAs may issue. Browsers mostly ignore DANE. CAA is the practical issuance control. A URL roast does not check CAA or TLSA.
- [CSRF Tokens vs SameSite for State-Changing Forms](https://roastmyopsec.com/blog/csrf-tokens-vs-samesite-for-state-changing-forms): CSRF tokens vs SameSite is a form-defense pairing, not a pick-one toggle. SameSite limits when cookies ride along. Tokens plus Origin checks still matter for state-changing POSTs.
- [CSP worker-src vs script-src for Workers and Service Workers](https://roastmyopsec.com/blog/csp-worker-src-vs-script-src): CSP worker-src vs script-src is a fetch allowlist for Worker, SharedWorker, and Service Worker scripts versus page JavaScript. script-src does not always cover workers. A URL roast grades CSP quality; it does not score worker-src alone.
- [CSP vs X-Frame-Options for Clickjacking Protection](https://roastmyopsec.com/blog/csp-vs-x-frame-options-for-clickjacking): CSP frame-ancestors vs X-Frame-Options is a framing-control decision for public sites. Learn when each header wins and what RoastMyOpsec checks.
- [CSP style-src vs unsafe-inline for Public Sites](https://roastmyopsec.com/blog/csp-style-src-vs-unsafe-inline): CSP style-src vs unsafe-inline is an allowlist for stylesheets versus a hole that lets injected CSS run. Nonces and hashes beat unsafe-inline. A URL roast grades CSP quality; it does not score style-src alone.
- [CSP strict-dynamic vs Nonce Host Allowlists](https://roastmyopsec.com/blog/csp-strict-dynamic-vs-nonce-allowlists): CSP strict-dynamic vs nonce host allowlists is how trusted scripts may load children. strict-dynamic ignores host lists in supporting browsers. Nonces without it still need every script marked.
- [CSP script-src-elem vs script-src for Public Sites](https://roastmyopsec.com/blog/csp-script-src-elem-vs-script-src): CSP script-src-elem vs script-src is <script> tags versus the combined script allowlist. script-src also covers handlers and can fall back for workers. A URL roast grades CSP quality; it does not score script-src-elem as a standalone F.
- [CSP sandbox vs iframe sandbox for Public Pages](https://roastmyopsec.com/blog/csp-sandbox-vs-iframe-sandbox): CSP sandbox vs iframe sandbox is a document-wide sandbox header versus a flag on an embed you include. Neither replaces frame-ancestors. A URL roast grades framing headers; it does not score CSP sandbox as a standalone F.
- [CSP require-sri-for vs Integrity-Policy for CDN Scripts](https://roastmyopsec.com/blog/csp-require-sri-for-vs-integrity-policy): CSP require-sri-for vs Integrity-Policy is a deprecated CSP directive versus a dedicated integrity header. Prefer Integrity-Policy plus real SRI hashes. A URL roast looks for missing integrity on tags; it does not score either header as a standalone F.
- [CSP report-uri vs Report-To for Violation Reports](https://roastmyopsec.com/blog/csp-report-uri-vs-report-to): CSP report-uri vs Report-To is a telemetry decision. report-uri is the older CSP directive. Report-To (and Reporting-Endpoints) is the Reporting API. Marketing sites need a collector they actually read. A header scan does not prove reports arrive.
- [CSP Report-Only vs Enforcing CSP for Marketing Sites](https://roastmyopsec.com/blog/csp-report-only-vs-enforcing-csp): CSP report-only vs enforcing CSP is a rollout decision. Report-Only collects violations without breaking checkout widgets. Enforcing CSP is the actual guardrail. Public sites should graduate, not live in report-only forever.
- [CSP object-src vs Browser Plugins on Public Sites](https://roastmyopsec.com/blog/csp-object-src-vs-plugins): CSP object-src vs plugins is a fetch allowlist for <object>, <embed>, and <applet>. object-src 'none' is a day-one default. It is not script-src. A URL roast grades CSP quality; it does not score object-src alone.
- [CSP Nonces vs Hashes for Script Allowlists](https://roastmyopsec.com/blog/csp-nonces-vs-hashes-for-scripts): CSP nonces vs hashes is how you allow first-party scripts without unsafe-inline. Nonces rotate per response. Hashes pin exact inline bytes. Host allowlists and unsafe-inline are the usual marketing-site miss. A header scan cannot prove your nonce rotates.
- [CSP media-src vs Mixed Content for Public Video](https://roastmyopsec.com/blog/csp-media-src-vs-mixed-content): CSP media-src vs mixed content is a video/audio allowlist versus HTTP media on an HTTPS page. Mixed content is the scheme bug. media-src is which hosts may load. A URL roast does not score media-src as a standalone F.
- [CSP manifest-src vs Web App Manifest for Public Sites](https://roastmyopsec.com/blog/csp-manifest-src-vs-web-app-manifest): CSP manifest-src vs a web app manifest is which hosts may load the JSON versus the PWA file itself. Manifests are meant to be public. Missing manifest-src is not a roast F. A URL roast does not score /manifest.json.
- [CSP img-src vs Mixed Content for Public Sites](https://roastmyopsec.com/blog/csp-img-src-vs-mixed-content): CSP img-src vs mixed content is an image allowlist versus HTTP assets on an HTTPS page. Mixed content is the scheme bug. img-src is which hosts may load. A URL roast parses http:// images in HTML; it does not score img-src alone.
- [CSP frame-src vs object-src for Embeds on Public Sites](https://roastmyopsec.com/blog/csp-frame-src-vs-object-src): CSP frame-src vs object-src is iframes versus plugin/embed tags. YouTube is frame-src. Flash-shaped <object> is object-src. frame-ancestors is who may frame you. A URL roast grades CSP quality; it does not score frame-src alone.
- [CSP frame-ancestors none vs self for Clickjacking](https://roastmyopsec.com/blog/csp-frame-ancestors-none-vs-self): CSP frame-ancestors none vs self is who may iframe you. none blocks all parents. self allows your origin only. Brochure sites usually want none plus a matching X-Frame-Options.
- [CSP form-action vs Open Redirects on Public Sites](https://roastmyopsec.com/blog/csp-form-action-vs-open-redirects): CSP form-action vs open redirects is a submit-target allowlist versus a Location hop. form-action limits where HTML forms may POST. It does not fix a /out?url= redirect. A URL roast follows public redirects; it does not score form-action.
- [CSP font-src vs Hosted Web Fonts on Public Sites](https://roastmyopsec.com/blog/csp-font-src-vs-hosted-web-fonts): CSP font-src vs hosted web fonts is an allowlist for @font-face versus a third-party font CDN. font-src does not cover CSS. Self-host fonts when you can. A URL roast grades CSP quality; it does not score font-src alone.
- [CSP default-src vs Named Directives for Public Sites](https://roastmyopsec.com/blog/csp-default-src-vs-named-directives): CSP default-src vs named directives is a fallback allowlist versus script-src, img-src, and friends. default-src is not a WAF. Name the fetches that matter. A URL roast grades CSP quality; it does not score missing default-src as the only F.
- [CSP connect-src vs Public JavaScript API Keys](https://roastmyopsec.com/blog/csp-connect-src-vs-javascript-api-keys): CSP connect-src vs public JS keys is a fetch allowlist versus a secret that should not be in the bundle. connect-src limits where XHR/fetch/WebSocket may go. It does not hide a key. A URL roast looks for JS secret shapes; it does not score connect-src.
- [CSP child-src vs worker-src for Public Sites](https://roastmyopsec.com/blog/csp-child-src-vs-worker-src): CSP child-src vs worker-src is a deprecated combined allowlist versus workers and frames split apart. Prefer worker-src and frame-src. A URL roast grades CSP quality; it does not score child-src as a standalone F.
- [CSP base-uri vs Open Redirects on Public Sites](https://roastmyopsec.com/blog/csp-base-uri-vs-open-redirects): CSP base-uri vs open redirects is a <base href> allowlist versus a Location hop. base-uri stops a surprise document base. It does not fix /out?url=. A URL roast does not score base-uri.
- [COOP vs COEP for Cross-Origin Isolation on Public Sites](https://roastmyopsec.com/blog/coop-vs-coep-for-cross-origin-isolation): COOP vs COEP is a browsing-context isolation decision. Cross-Origin-Opener-Policy cuts window.opener ties. Cross-Origin-Embedder-Policy is stricter and often breaks marketing widgets. Most brochure sites want COOP first, not a full isolation bundle.
- [COOP same-origin-allow-popups vs same-origin](https://roastmyopsec.com/blog/coop-allow-popups-vs-same-origin): COOP same-origin-allow-popups vs same-origin is whether window.open popups may share a browsing context group. same-origin is tighter. allow-popups keeps OAuth and payment windows working.
- [Cookie Max-Age vs Session Cookies for Login Lifetime](https://roastmyopsec.com/blog/cookie-max-age-vs-session-cookies): Cookie Max-Age vs session cookies is a lifetime decision, not a lock. Session cookies omit Max-Age; persistent cookies set a clock. Auth still needs Secure, HttpOnly, and SameSite.
- [Clear-Site-Data vs Cookie Expiry on Logout](https://roastmyopsec.com/blog/clear-site-data-vs-cookie-expiry-on-logout): Clear-Site-Data vs cookie expiry is a logout-hygiene decision. Expiring the session cookie ends the server session. Clear-Site-Data can wipe cookies, storage, and cache for the origin. Marketing sites that only Max-Age=0 still leave JWTs in localStorage.
- [Certificate Expiry vs HSTS for Public Website TLS](https://roastmyopsec.com/blog/certificate-expiry-vs-hsts-for-public-sites): Certificate expiry vs HSTS is a transport-ops decision. A live cert proves this handshake. HSTS remembers HTTPS for later visits. Public sites need both, plus expiry monitoring the scanner cannot replace.
- [Cache-Control public vs private for Personalized Pages](https://roastmyopsec.com/blog/cache-control-public-vs-private-for-personalized-pages): Cache-Control public vs private is a shared-cache decision. Public plus Set-Cookie is how personalized HTML becomes community theater. Learn which responses may be stored where.
- [CAA Records vs Registrar Lock for Domain OPSEC](https://roastmyopsec.com/blog/caa-records-vs-registrar-lock): CAA vs registrar lock is a domain-control split. CAA limits which CAs may issue certificates for your names. Registrar lock stops unauthorized transfers. Public sites usually need both; neither replaces DNS hygiene.

## Blog — Vulnerabilities
- [yarn.lock vs package.json on Production Origins](https://roastmyopsec.com/blog/yarn-lock-vs-package-json-on-production): yarn.lock vs package.json is exact pins versus declared inventory on a public origin. Both are maps, not marketing assets. A URL roast signatures /package.json; yarn.lock is the same class of miss. Deny the names at the CDN.
- [wp-config.php.bak vs .env on Production Origins](https://roastmyopsec.com/blog/wp-config-bak-vs-env-on-production): wp-config.php.bak vs .env is two secret files that must not be downloadable. Editor backups and dotenv both donate DB credentials. Deny the names at the CDN. A URL roast signatures .env; wp-config backups are the same class of miss.
- [WordPress XML-RPC vs wp-login.php for Public Site OPSEC](https://roastmyopsec.com/blog/wordpress-xmlrpc-vs-wp-login): XML-RPC vs wp-login.php is two WordPress auth doors. The HTML login is the one humans see. xmlrpc.php is an API many brochure sites do not need. MFA and rate limits must cover both. A URL roast does not password-spray either.
- [WordPress debug.log vs Framework Debug on Production](https://roastmyopsec.com/blog/wordpress-debug-log-vs-framework-debug): WordPress debug.log vs framework debug is a logfile in wp-content versus a global DEBUG flag. Neither belongs world-readable. A URL roast does not fetch debug.log and does not flip WP_DEBUG.
- [WebSockets vs CORS for Browser APIs](https://roastmyopsec.com/blog/websocket-vs-cors-for-browser-apis): WebSockets vs CORS is an upgrade handshake versus a fetch allowlist. Browsers do not apply Access-Control-Allow-Origin to WebSocket. The server must check Origin and authenticate. A URL roast reads ACAO on HTTP; it does not open WebSockets.
- [.vscode vs .DS_Store on Production Origins](https://roastmyopsec.com/blog/vscode-folder-vs-ds-store-on-production): .vscode vs .DS_Store is IDE metadata versus Finder leftovers on a public origin. Workspace settings can name paths, tasks, and sometimes tokens. Strip editor folders in CI and deny them at the CDN. A URL roast signatures .DS_Store; .vscode is the same class of miss.
- [Verbose API Errors vs Generic Client Messages](https://roastmyopsec.com/blog/verbose-api-errors-vs-generic-client-messages): Verbose API errors vs generic client messages is a reconnaissance decision. Stack traces, SQL fragments, and paths in JSON are free maps. Keep novels in server logs.
- [Timing-Allow-Origin vs CORS for Cross-Origin Telemetry](https://roastmyopsec.com/blog/timing-allow-origin-vs-cors): Timing-Allow-Origin vs CORS is a telemetry vs data-access decision. CORS decides whether JS on another origin may read the response. TAO decides whether Resource Timing is unmasked. Marketing RUM often wants TAO. APIs should not copy TAO * from a CDN snippet blindly.
- [Thumbs.db vs .DS_Store on Production CDNs](https://roastmyopsec.com/blog/thumbs-db-vs-ds-store-on-production): Thumbs.db vs .DS_Store is two desktop leftovers on a public origin. Windows thumbnail caches and Finder metadata both donate filenames. Strip them in CI and deny the names at the CDN. A URL roast signatures .DS_Store; Thumbs.db is the same class of miss.
- [Terraform tfstate vs .env on Production Origins](https://roastmyopsec.com/blog/terraform-tfstate-vs-env-on-production): terraform.tfstate vs .env is infrastructure state versus app secrets. State often holds the same class of material. Deny the name at the CDN. A URL roast signatures /.env; tfstate is the same class of miss.
- [Swagger UI vs GraphQL Introspection on Production APIs](https://roastmyopsec.com/blog/swagger-ui-vs-graphql-introspection): Swagger UI vs GraphQL introspection is two API maps on a public origin. Both donate schema. Production APIs should not ship interactive docs or open introspection. A URL roast may probe GraphQL __schema; it does not score /swagger.
- [Subresource Integrity vs Unpinned CDN Scripts](https://roastmyopsec.com/blog/subresource-integrity-vs-unpinned-cdn-scripts): SRI vs unpinned CDN scripts is a supply-chain decision. Integrity hashes pin what the browser will execute. Unpinned third-party JS is a lottery ticket you did not mean to buy.
- [Spring Actuator vs Apache server-status on Production](https://roastmyopsec.com/blog/spring-actuator-vs-server-status): Spring Actuator vs server-status is two operator dashboards. /actuator/env and /server-status donate config and workers. Keep them off the public origin. A URL roast does not score Actuator or mod_status today.
- [Soft 404 vs Hard 404 for Sensitive Paths](https://roastmyopsec.com/blog/soft-404-vs-hard-404-for-sensitive-paths): Soft 404 vs hard 404 is an evidence decision. A 200 SPA shell on /.env is not a miss, and a 404 HTML homepage is not proof the file is gone. Grade the body, then deny the path at the edge anyway.
- [sitemap.xml vs robots.txt for Hidden Paths](https://roastmyopsec.com/blog/sitemap-xml-vs-robots-txt-for-hidden-paths): sitemap.xml vs robots.txt is a map versus a polite ask. Sitemaps list URLs you want indexed. robots.txt Disallow is not access control. Do not put admin, dumps, or signed URLs in either file. A URL roast reads robots.txt; it does not score sitemap.xml.
- [Apache server-status vs phpinfo() on Production](https://roastmyopsec.com/blog/server-status-vs-phpinfo-on-production): server-status vs phpinfo is two diagnostic dashboards on a public origin. mod_status and PHP's phpinfo() both donate versions, workers, and paths. Deny them at the edge. A URL roast does not score /server-status today.
- [robots.txt Disallow vs Access Control for Hidden Paths](https://roastmyopsec.com/blog/robots-txt-disallow-vs-access-control): robots.txt Disallow vs access control is the difference between asking crawlers nicely and actually denying HTTP. Disallow is not a vault.
- [requirements.txt vs package.json on Production Origins](https://roastmyopsec.com/blog/requirements-txt-vs-package-json-on-production): requirements.txt vs package.json is Python versus Node inventory on a public origin. Both donate names and versions. Deny them at the CDN. A URL roast signatures /package.json; requirements.txt is the same class of miss.
- [Rails master.key vs .env on Production Origins](https://roastmyopsec.com/blog/rails-master-key-vs-env-on-production): Rails master.key vs .env is the credentials encryption key versus dotenv secrets. Both are incident-class on a public origin. Deny the name at the CDN. A URL roast signatures /.env; master.key is the same class of miss.
- [pubspec.yaml vs package.json on Production Origins](https://roastmyopsec.com/blog/pubspec-yaml-vs-package-json-on-production): pubspec.yaml vs package.json is Dart versus Node inventory on a public origin. Both donate package names and versions. Deny them at the CDN. A URL roast signatures /package.json; pubspec.yaml is the same class of miss.
- [Public package.json vs Lockfile Advisories on Production](https://roastmyopsec.com/blog/public-package-json-vs-lockfile-advisories): Public package.json vs a lockfile advisory is an inventory vs CVE decision. A reachable /package.json donates names and versions on the CDN. OSV on a private lockfile is a different channel. Neither is a pentest.
- [Public JavaScript API Keys vs Server Secrets](https://roastmyopsec.com/blog/public-javascript-api-keys-vs-server-secrets): Public JS API keys vs server secrets is a placement decision. Anything in a browser bundle is public. Learn which tokens can live client-side and which must never ship.
- [Production Source Maps: When They Leak Source and Secrets](https://roastmyopsec.com/blog/production-source-maps-when-they-leak): Production source maps leak original TypeScript and comments when .map files or sourceMappingURL stay public. Learn when maps help debugging and when they become an OPSEC miss.
- [postMessage vs CORS for Embedded Widgets](https://roastmyopsec.com/blog/postmessage-vs-cors-for-embeds): postMessage vs CORS is window messaging versus fetch read access. targetOrigin must be explicit. * plus secrets in the payload is the miss. A URL roast does not send postMessage and does not score targetOrigin.
- [pnpm-lock.yaml vs package.json on Production Origins](https://roastmyopsec.com/blog/pnpm-lock-vs-package-json-on-production): pnpm-lock.yaml vs package.json is pnpm pins versus declared inventory on a public origin. Both are maps. A URL roast signatures /package.json; the pnpm lockfile is the same class of miss. Deny the names at the CDN.
- [phpMyAdmin vs /wp-admin on Public Marketing Origins](https://roastmyopsec.com/blog/phpmyadmin-vs-wp-admin-public-origin): phpMyAdmin vs /wp-admin is a leftover-console vs CMS-admin decision. WordPress /wp-admin is expected on a public CMS. phpMyAdmin on the same origin is a database GUI that should not face the internet. Discoverability is not a bypass.
- [phpinfo() vs Verbose API Errors on Production](https://roastmyopsec.com/blog/phpinfo-vs-verbose-api-errors): phpinfo() vs verbose API errors is a diagnostic dump versus a stack trace in JSON. Both donate versions, paths, and config. Neither belongs on a public origin. A URL roast does not fetch phpinfo.php and does not fuzz error messages.
- [.user.ini vs .htaccess on Production Origins](https://roastmyopsec.com/blog/php-user-ini-vs-htaccess-on-production): .user.ini vs .htaccess is PHP per-directory config versus Apache per-directory config. Neither should be a downloadable object. Deny the names at the CDN. A URL roast does not score these files today; they are the same class of miss as /.env.
- [Open Redirects vs Tokens in URLs](https://roastmyopsec.com/blog/open-redirects-vs-tokens-in-urls): Open redirects vs tokens in URLs is a trust-boundary decision. Cross-site hops expand who sees the next location. Credentials in query strings leak through logs and Referer. Collapse both.
- [.npmrc vs an npm Token on Production Origins](https://roastmyopsec.com/blog/npmrc-vs-npm-token-on-production): .npmrc vs an npm token is a registry-config file versus a credential. Neither belongs next to index.html. Deny the name at the CDN. A URL roast may not fetch .npmrc today; it is the same class of miss as /.env.
- [Next.js .env.local vs .env on Production Origins](https://roastmyopsec.com/blog/next-env-local-vs-env-on-production): Next.js .env.local vs .env is local overrides versus shared dotenv. Both are incident-class on a public origin. RoastMyOpsec signatures /.env and /.env.local today. Deny the names at the CDN. Do not advertise them in robots.txt.
- [kubeconfig vs .env on Production Origins](https://roastmyopsec.com/blog/kubeconfig-vs-env-on-production): kubeconfig vs .env is cluster access material versus app secrets. Both are incident-class if they are public objects. Deny the name at the CDN. A URL roast signatures /.env; kubeconfig is the same class of miss.
- [JSONP vs CORS for Public Browser APIs](https://roastmyopsec.com/blog/jsonp-vs-cors-for-public-apis): JSONP vs CORS is a 2000s callback versus a real cross-origin policy. JSONP loads your API as a script with no origin allowlist. Retire callback= parameters. Use CORS with a named origin. A URL roast reads ACAO; it does not execute JSONP.
- [id_rsa vs .env on Production Origins](https://roastmyopsec.com/blog/id-rsa-vs-env-on-production): id_rsa vs .env is a private SSH key versus app secrets on a public origin. Both are incident-class. Deny the name at the CDN. A URL roast signatures /.env; private keys are the same class of miss.
- [HTTP TRACE vs Least-Privilege Methods for Public APIs](https://roastmyopsec.com/blog/http-trace-vs-least-privilege-methods): HTTP TRACE vs least-privilege methods is a verb-surface decision. Extra advertised methods expand attack surface. TRACE is a classic footgun. Allow only the verbs each route needs.
- [.htaccess vs web.config on a Public Origin](https://roastmyopsec.com/blog/htaccess-vs-web-config-on-production): .htaccess vs web.config is two server config files that must not be downloadable next to index.html. They can name rewrite rules, deny lists, and sometimes credentials. Deny the names at the CDN. A URL roast does not fetch these files today.
- [GraphQL Introspection vs Production APIs](https://roastmyopsec.com/blog/graphql-introspection-vs-production-apis): GraphQL introspection vs a locked production API is a schema-publication decision. Introspection is useful and not a breach by itself. Private APIs often should not ship the whole menu.
- [go.mod vs package.json on Production Origins](https://roastmyopsec.com/blog/go-mod-vs-package-json-on-production): go.mod vs package.json is Go versus Node inventory on a public origin. Both donate module paths and versions. Deny them at the CDN. A URL roast signatures /package.json; go.mod is the same class of miss.
- [.gitmodules vs .git/HEAD on Production Origins](https://roastmyopsec.com/blog/gitmodules-vs-git-head-on-production): .gitmodules vs .git/HEAD is a submodule map versus a VCS dump signature. Both must not be public objects. RoastMyOpsec signatures /.git/HEAD; .gitmodules is the same class of miss. Deny the names at the CDN, not in robots.txt.
- [Gemfile vs package.json on Production Origins](https://roastmyopsec.com/blog/gemfile-vs-package-json-on-production): Gemfile vs package.json is Ruby versus Node inventory on a public origin. Both donate names and versions. Deny them at the CDN. A URL roast signatures /package.json; Gemfile is the same class of miss.
- [Framework Debug Mode vs Verbose API Errors](https://roastmyopsec.com/blog/framework-debug-vs-verbose-api-errors): Framework debug mode vs verbose API errors is APP_DEBUG / DEBUG=True versus a single chatty 500. Debug mode is a whole-site yellow page. Turn it off in production. A URL roast may heuristic-scan error bodies; it does not flip debug flags.
- [firebase.json vs package.json on Production Origins](https://roastmyopsec.com/blog/firebase-json-vs-package-json-on-production): firebase.json vs package.json is Firebase Hosting config versus Node inventory on a public origin. Both donate internals. Deny them at the CDN. A URL roast signatures /package.json; firebase.json is the same class of miss.
- [Exposed .svn vs .git on Production Websites](https://roastmyopsec.com/blog/exposed-svn-vs-git-on-production): Exposed .svn vs .git is two VCS leftovers on a public origin. Both can donate source and history. Deny the directories at the CDN. A URL roast signatures .git/HEAD; .svn is the same class of miss.
- [Exposed Procfile vs package.json on Production Origins](https://roastmyopsec.com/blog/exposed-procfile-vs-package-json): Procfile vs package.json is process-type inventory versus Node inventory on a public origin. Both are maps. A URL roast signatures /package.json; Procfile is the same class of miss. Deny the names at the CDN.
- [Exposed .hg vs .git on Production Websites](https://roastmyopsec.com/blog/exposed-hg-vs-git-on-production): Exposed .hg vs .git is two VCS leftovers on a public origin. Mercurial working copies leak history like Git. Deny both prefixes at the CDN. A URL roast signatures .git/HEAD; .hg is the same class of miss.
- [Exposed .git vs .env on Production Websites](https://roastmyopsec.com/blog/exposed-git-vs-env-on-production): Exposed .git vs .env is a production-root exposure decision: both are incident-class leaks, but they leak different things and need different edge rules.
- [.env.example vs .env on Production Origins](https://roastmyopsec.com/blog/env-example-vs-env-on-production): .env.example vs .env is a template versus live secrets. A public /.env is incident-class. A public /.env.example can still donate key names and copied values. Deny both at the CDN. A URL roast signatures .env; .env.example is the same class of miss.
- [ELMAH vs trace.axd on Production ASP.NET Sites](https://roastmyopsec.com/blog/elmah-vs-trace-axd-on-production): ELMAH vs trace.axd is two ASP.NET diagnostic surfaces. /elmah.axd and /trace.axd can list exceptions, paths, and request detail. Keep them off the public origin. A URL roast does not score either path today.
- [Exposed dump.sql vs backup.zip on Production](https://roastmyopsec.com/blog/dump-sql-vs-backup-zip-on-production): dump.sql vs backup.zip is two archive-class leaks on a public origin. A SQL dump is often the database in text. A zip is a bundle that may contain the same plus .env. Bounded signature checks, not a treasure hunt.
- [.DS_Store vs Directory Listing for Leftovers on Production](https://roastmyopsec.com/blog/ds-store-vs-directory-listing-on-production): .DS_Store vs directory listing is an inventory-leak decision. Finder metadata on the CDN can name files you thought were hidden. Autoindex is louder. Neither belongs on a public origin. A URL roast looks for a signature, not a full parse.
- [.dockerignore vs Dockerfile on Production Origins](https://roastmyopsec.com/blog/dockerignore-vs-dockerfile-on-production): .dockerignore vs Dockerfile is two Docker build files that must not sit next to index.html. The ignore file hints at what you hid from the image. Deny both names at the CDN. A URL roast signatures /package.json, not these files, today.
- [Dockerfile vs package.json on Production Origins](https://roastmyopsec.com/blog/dockerfile-vs-package-json-on-production): Dockerfile vs package.json is two inventory files that must not sit next to index.html. Both donate names, versions, and sometimes secrets. Deny them at the CDN. A URL roast signatures /package.json; Dockerfile is the same class of miss.
- [Directory Listing vs 403 for Backup and Static Folders](https://roastmyopsec.com/blog/directory-listing-vs-403-for-backup-folders): Directory listing vs 403 is an inventory decision. Autoindex turns a folder into a map of backups and dumps. A hard deny hides the map. A reachable backup.zip is still an incident even without a listing.
- [desktop.ini vs Thumbs.db on Production CDNs](https://roastmyopsec.com/blog/desktop-ini-vs-thumbs-db-on-production): desktop.ini vs Thumbs.db is two Windows folder leftovers on a public origin. Both can donate filenames and folder customization. Strip them in CI and deny the names at the CDN. A URL roast signatures .DS_Store; these are the same class of miss.
- [crossdomain.xml vs CORS for Public Browser APIs](https://roastmyopsec.com/blog/crossdomain-xml-vs-cors-for-public-apis): crossdomain.xml vs CORS is a Flash-era allowlist versus Fetch CORS headers. A public /crossdomain.xml with * is a leftover policy file, not modern CORS. Delete it. A URL roast reads ACAO; it does not score crossdomain.xml.
- [CORS Wildcard vs Allowlist for Public APIs](https://roastmyopsec.com/blog/cors-wildcard-vs-allowlist-for-public-apis): CORS wildcard vs an origin allowlist is an API trust decision. * is for truly public, credential-free reads. Sessioned APIs need exact origins — never * with credentials.
- [CORS Credentials vs Wildcard Origins](https://roastmyopsec.com/blog/cors-credentials-vs-wildcard-origins): CORS credentials vs wildcard origins is a spec conflict. Access-Control-Allow-Credentials: true cannot pair with Access-Control-Allow-Origin: *. Browsers reject the combination. Cookie-bearing APIs need a named origin allowlist. A URL roast reads ACAO; it does not steal sessions.
- [CORP vs CORS for Embedding and Fetch Isolation](https://roastmyopsec.com/blog/corp-vs-cors-for-embedding-isolation): CORP vs CORS is a no-vs-yes decision. Cross-Origin-Resource-Policy tells other sites they may not load this resource as a no-cors subresource. CORS tells named origins they may read it. Public APIs need an allowlist. Static assets need a CORP that matches how you embed them.
- [composer.json vs package.json on Production Origins](https://roastmyopsec.com/blog/composer-json-vs-package-json-on-production): composer.json vs package.json is PHP versus Node inventory on a public origin. Both donate names and versions. Deny them at the CDN. A URL roast signatures /package.json; composer.json is the same class of miss.
- [CircleCI config vs GitHub Workflows on Production Origins](https://roastmyopsec.com/blog/circleci-config-vs-github-workflows-on-production): CircleCI config vs GitHub Actions workflows is two CI YAML trees that must not be public CDN objects. Both can name secrets, orbs, and deploy targets. Deny the names at the edge. A URL roast may not fetch either today.
- [Cargo.toml vs package.json on Production Origins](https://roastmyopsec.com/blog/cargo-toml-vs-package-json-on-production): Cargo.toml vs package.json is Rust versus Node inventory on a public origin. Both donate crate names and versions. Deny them at the CDN. A URL roast signatures /package.json; Cargo.toml is the same class of miss.
- [backup.sql.gz vs dump.sql on Production Origins](https://roastmyopsec.com/blog/backup-sql-gz-vs-dump-sql): backup.sql.gz vs dump.sql is a compressed database souvenir versus a plaintext dump. Both are data-class leaks on a public origin. Deny archive names at the CDN. A URL roast signatures /dump.sql and /backup.zip; .sql.gz may not be fetched today.
- [AWS Credentials File vs .env on Production Origins](https://roastmyopsec.com/blog/aws-credentials-file-vs-env-on-production): An AWS credentials file vs .env is two places long-lived keys must not become public objects. Deny the name at the CDN. A URL roast signatures /.env; credentials files are the same class of miss.
- [App Auth Paths vs Website Login Pages](https://roastmyopsec.com/blog/app-auth-paths-vs-website-login): App auth paths vs website login pages is a scan-mode and surface decision. /login on a brochure host is not the same as /oauth, /graphql, and /api on the app origin. Inventory both; protect both.
- [Admin Login Discoverability vs Access Control](https://roastmyopsec.com/blog/admin-login-discoverability-vs-access-control): Admin login discoverability vs access control is not the same problem. A visible /admin is inventory. SSO, MFA, and rate limits are the control. Hiding the path is not a vault.
- [Access-Control-Expose-Headers vs CORS Allow-Origin](https://roastmyopsec.com/blog/access-control-expose-headers-vs-cors): Access-Control-Expose-Headers vs CORS is which response headers JS may read versus which origins may read the body. ACEH is not an allowlist of callers. A URL roast reads ACAO; it does not score Expose-Headers.

## Optional
- [Full LLM text](https://roastmyopsec.com/llms-full.txt): Concatenated product summary plus every public guide (answers, sections, FAQs).
- [RSS](https://roastmyopsec.com/blog/rss.xml): Blog feed.
- [Sitemap](https://roastmyopsec.com/sitemap.xml): Indexable HTML URLs for search engines.
- [robots.txt](https://roastmyopsec.com/robots.txt): Crawl policy. Not a list of hidden admin paths.
- [Privacy](https://roastmyopsec.com/privacy): What a scan collects.
- [Terms](https://roastmyopsec.com/terms): Consent-based, defensive-use terms.
- [GitHub](https://github.com/mblackth-ai/roastmyopsec): Source repository.