Web app security, explained

Content-Security-Policy (CSP): what it is and how to add one

The header that stops injected scripts from running.

HTTP Strict Transport Security (HSTS) explained

Force every connection to use HTTPS — even the first one.

Clickjacking and X-Frame-Options: keep your pages out of iframes

One header stops attackers from overlaying your app inside an iframe.

MIME sniffing and X-Content-Type-Options: nosniff explained

One header stops browsers from guessing content types and running uploads as scripts.

Misconfigurations

Exposed .env files: how attackers find your secrets

A single reachable .env can hand over your whole stack.

CORS misconfiguration: the wildcard and reflection traps

Allow every origin and any site can read your API.

Source maps in production leak your source code

Shipped .map files hand over your original source.

Exposed .git directory: the source-code leak hiding in plain sight

A reachable /.git hands over your entire codebase and commit history.

Exposed database backups: what happens when /backup.sql is reachable

A reachable .sql dump is a complete hand-off of your entire database.

Exposed Secrets

API keys exposed in client-side JavaScript

Anything in your bundle is public. Treat it that way.

DNS & Email Security

Subdomain takeover: how it happens and how to prevent it

A dangling CNAME is an open door on your domain.

SPF and DMARC: stop email spoofing of your domain

Stop attackers from emailing the world as you.

Cookie Security

Secure, HttpOnly, and SameSite cookie flags

Three flags that keep session cookies from being stolen.

Redirect Chain

Why your site needs an HTTP→HTTPS redirect

Don't leave the insecure door open.

Database Security

Supabase Row Level Security (RLS): lock down your tables

Your anon key is public. RLS is the only thing between it and your data.

Firebase Security Rules: stop leaving your database open

Your Firebase config is public by design. Your rules decide who sees the data.

File, Path & Resource Handling

Open directory indexes: when your file server lists everything

A file server that lists its contents hands attackers a free inventory.

Error Handling & Resilience

Verbose error pages and stack traces in production

A stack trace tells attackers exactly where to aim.

API Security

Public GraphQL introspection: why it's a problem and how to turn it off

A single query returns your entire schema. Turn it off in production.

Server-Side Request & HTTP Protocol