Knowledge base

CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy: what each one does and how to add them.

Why HTTPS isn't negotiable, how to force the redirect, and how to enable HSTS once it's in place.

The three cookie attributes that determine what can steal or replay it, and how to configure them.

Access-Control-Allow-Origin: * on a response that contains data: what it exposes and how to restrict it.

sk_live_ or sk_test_ in the browser JavaScript — the most severe and most common vulnerability.

Tables readable without authentication, or an exposed service_role key: how to check and fix it.

Two files that should never respond over HTTP, and how to block access to them depending on your host.

AWS keys, tokens, passwords written directly into the JavaScript instead of server-side variables.

The .map file that reconstructs your entire unminified source code, comments included.

Individually low-severity clues that still help an attacker aim their next attempt.

Outdated TLS protocol, expired, self-signed, or mismatched certificate: what each case means and how to fix it.

PUT/DELETE/TRACE advertised by the server, and directories that list their files instead of returning an error.

CVE, CVSS score, patched version, active exploitation (CISA KEV) and EPSS probability for every vulnerable package in your package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, or composer.lock.

A real TRACE request sent, credentialed CORS tested with a made-up origin, a Stripe key actually called, a Supabase write attempted then cleaned up — the difference between "probably vulnerable" and "proven vulnerability".