26 articles published
A script-src carrying 'unsafe-inline' passes every presence check and stops no injection. The theatre policy, the working one, and the war story of a strict CSP that broke sign-up with no error anywhere.
The cheapest finding on your report to fix — one header — and the easiest to get wrong in three specific ways. The exact fix for nginx, Apache, Caddy and Next.js, and how to prove it worked.
One curl command shows you every security header your site sends. This guide is the decoder: what each header stops, what its absence costs, and the three that matter most.
Most flagged dependencies are not exploitable in your application. Five questions that separate the ones that matter from the ones that generate tickets — and what to do when the answer is genuinely no.
Without DMARC, anyone can send mail that says it is from your domain and no receiving server has instructions to stop them. The three records, the rollout that does not break your own mail, and the duplicate-record trap that silently disables the whole thing — which we walked into ourselves.
Before the first call, somebody on the buyer's side points a scanner at your domain. What they see, the questionnaire answers passive monitoring writes for you, and the posture ladder to climb before paying for an audit.
An expired certificate is a full outage with a scary error page, and certificate lifetimes just got cut in half — renewals you handled yearly are now a several-times-a-year event. The checks, the automation, and why automation still needs a watcher.
An agency's security surface is every site it ever shipped, including the ones nobody bills for any more. The risks specific to running many sites with a small team, the per-client baseline worth standardizing, and the honest case for monitoring as a service line.
Contact
Questions about what the engine checks, whether it fits your estate, or what it deliberately refuses to do. A person reads every message.
26 articles found