Practical, no-fluff writeups on performance, security, browser auditing, and code quality.
More Security
SSL Labs' exhaustive protocol enumeration set the standard for TLS testing - but cached results and no scheduling send people looking for alternatives. Here's an honest comparison, including the one thing a single-connection check genuinely can't match.
A practical framework for triaging vulnerability alerts - what severity and CVSS actually mean, when to patch versus mitigate, and how to close the loop without losing track of what you've deferred.
OWASP ZAP is a genuinely powerful free active security scanner - and a lot of tool to learn. Here's an honest look at real alternatives, and the real difference between active and passive scanning.
How an invisible iframe can trick a user into clicking something they never saw, and the header that stops your pages from being framed at all.
The handful of API security mistakes that show up constantly - missing rate limits, weak auth, and overly permissive CORS - and what a reasonable baseline actually looks like.
Why a redirect parameter that accepts any URL turns your own trusted domain into free phishing infrastructure, and how to lock it down.
What the same-origin policy actually restricts, what CORS headers do to relax it safely, and the wildcard-plus-credentials mistake that turns a convenience header into a critical exposure.
Three cookie flags, three completely different attacks they stop - what each one actually does, and why a cookie missing even one of them is a real, exploitable gap.
The industry's most-cited security list, translated out of developer jargon - what each category actually means for a site you own but didn't build yourself.
