Field notes from the swamp
Plain-English write-ups on the low-level security stuff that gets vibe coders shaken down — and how to shut it down.
The one file that makes shakedown artists move on
A security.txt file gives anyone who finds a bug a real way to reach you — turning a public dump or a ransom demand into a quiet heads-up. The exact lines to paste, where it goes, and the honest severity.
Your API key is in your JavaScript bundle
A secret key hardcoded into frontend code ships to every visitor's browser, readable in one click. Publishable vs. secret keys, the NEXT_PUBLIC_ footgun, the move-it-server-side fix — and why you have to rotate the moment it leaked.
You shipped your source code to production
A reachable source map turns your minified bundle back into your original, commented source — file structure, TODOs and all. What a .map leaks, how to check in one request, and the one build flag that turns it off.
The vibe coder's security checklist
The whole low-level hygiene list in one place — email, secrets, headers, cookies, subdomains, HTTPS, DNS — each linking to the five-minute fix.
One scan isn't enough
A scan is a snapshot; security is a moving target. How a clean report quietly rots — and what scheduled re-scanning catches before a shakedown artist does.
DNSSEC and CAA: the two records nobody sets
The deep cuts of DNS hygiene — what DNSSEC and CAA protect against, why they're mostly a toggle, and where they sit on the priority list.
Your HTTPS is lying to you
A valid cert is the start line, not the finish. The four TLS problems that still get flagged after you've got HTTPS — and how to fix each.
State of the Swamp: what the scans keep finding
First-party, zero-PII stats from every domain we've scanned — how many are spoofable, leak a secret, or miss basic headers, and how much scores climb after a scan.
Your session cookie is stealable
HttpOnly, Secure, and SameSite in plain English — what each flag stops, the exact settings to ship, and how to pick a SameSite value without logging your own users out.
Don't wait for the blog to find out if you're a target.
Scan your site free →