Posted in未分类
HTTP Headers Analyzer: The Six Headers Your Site Probably Forgot
If your site loads in a browser, the response carried instructions your users never read.…
Posted in未分类
The Watermark You Forgot to Add: Why Your Shared CSV Becomes a Liability the Day You Email It
The Watermark You Forgot to Add: Why Your Shared CSV Becomes a Liability the Day…
Posted in未分类
The Four Checks Most JWT Decoders Skip: Why Your Token Inspector Says Valid While Your IdP Knows It Isn’t
The Four Checks Most JWT Decoders Skip: Why Your Token Inspector Says "Valid" While Your…
Posted in未分类
The Three Lines in a WHOIS Record You Probably Should Not Trust
A domain name looks like the most public record on the internet. It is published…
Posted in未分类
The Bundle Your AES Key Should Have Shipped In: Why AES-256-GCM Is Not a Magic Word
AES-256-GCM is the easy part. The bundle format around it — IV, auth tag, key derivation, version field — is where 90% of real-world encryption failures live. Here is what a good bundle looks like and why the JSON wrapper is the actual feature.
Posted in未分类
The Regex That Sat Quietly in Production for Six Years: A ReDoS Story Nobody Caught in Code Review
The Regex That Sat Quietly in Production for Six Years: A ReDoS Story Nobody Caught…
Posted in未分类
The Payload Your Sanitizer Let Through: Why Boring XSS Still Ships
The email arrives at 6:14 a.m. A researcher has a stored XSS in your support…
Posted in未分类
The Five Lines of PII Quietly Sitting in Your Application Logs
The log file that should never have shipped The 47-megabyte Apache access log sat in…
Posted in未分类
The Five HTTP Headers That Quietly Decide Whether Your Site Gets Hacked
You shipped a feature on Friday afternoon. The build was green, the deploy went smoothly,…
Posted in未分类
Why a 10,000-URL List Always Hides 80 You Shouldn’t Trust
A 12,000-row backlink audit arrives from your SEO platform. The export looks clean: every row…