Practical, no-fluff writeups on performance, security, browser auditing, and code quality.
A WCAG 2.2 checklist covering all 55 Level A and AA success criteria in plain words, what is new in 2.2, and which checks an automated tool can run for you.
More guides
Why GraphQL introspection and public Swagger or OpenAPI docs help attackers map your API, when it is fine to leave them on, and how to disable GraphQL introspection in production.
The European Accessibility Act has applied since 28 June 2025. Who it covers, what it requires from websites and apps, the WCAG standard behind it, exemptions and a practical plan.
What a subdomain takeover is, how dangling CNAME records let attackers serve content on your domain, which services are affected, and how to find and fix them.
What is DMARC and why does every domain need it? How DMARC works with SPF and DKIM, how to read a DMARC record, and a safe path from p=none to p=reject.
A Black Friday website checklist for store owners and developers: page speed, checkout testing, broken links, SSL, SEO for sale pages and monitoring, with dates to work back from.
Gitleaks and TruffleHog are the two most popular open-source secret scanners. Here is how gitleaks vs trufflehog compares on detection, verification, speed, licensing and CI setup, and when to use each.
AI assistants now answer questions your pages used to rank for. Here is how to rank in ChatGPT, get cited by Perplexity and appear in Google AI Overviews, starting with the technical basics most sites get wrong.
AI coding agents load rules files as trusted instructions. The rules file backdoor hides attacker instructions in them with invisible Unicode and comments. Here is how it works and how to check your repo.
An AI bill of materials lists every model, AI provider, framework and agent tool your software depends on. Here is what belongs in an AI BOM, the standard formats, and how to generate one from your code.
