Skip to content
Blog

Field notes from the swamp

Plain-English write-ups on the low-level security stuff that gets vibe coders shaken down — and how to shut it down.

14 posts
Playbook

The one file that makes shakedown artists move on

A security.txt file gives anyone who finds a bug a real way to reach you — turning a public dump or a ransom demand into a quiet heads-up. The exact lines to paste, where it goes, and the honest severity.

Jul 14, 20264 min read
Playbook

Your API key is in your JavaScript bundle

A secret key hardcoded into frontend code ships to every visitor's browser, readable in one click. Publishable vs. secret keys, the NEXT_PUBLIC_ footgun, the move-it-server-side fix — and why you have to rotate the moment it leaked.

Jul 13, 20265 min read
Playbook

You shipped your source code to production

A reachable source map turns your minified bundle back into your original, commented source — file structure, TODOs and all. What a .map leaks, how to check in one request, and the one build flag that turns it off.

Jul 12, 20264 min read
Checklist

The vibe coder's security checklist

The whole low-level hygiene list in one place — email, secrets, headers, cookies, subdomains, HTTPS, DNS — each linking to the five-minute fix.

Jul 11, 20266 min read
Field note

One scan isn't enough

A scan is a snapshot; security is a moving target. How a clean report quietly rots — and what scheduled re-scanning catches before a shakedown artist does.

Jul 10, 20264 min read
Playbook

DNSSEC and CAA: the two records nobody sets

The deep cuts of DNS hygiene — what DNSSEC and CAA protect against, why they're mostly a toggle, and where they sit on the priority list.

Jul 9, 20265 min read
Playbook

Your HTTPS is lying to you

A valid cert is the start line, not the finish. The four TLS problems that still get flagged after you've got HTTPS — and how to fix each.

Jul 8, 20265 min read
Report

State of the Swamp: what the scans keep finding

First-party, zero-PII stats from every domain we've scanned — how many are spoofable, leak a secret, or miss basic headers, and how much scores climb after a scan.

Jul 7, 20264 min read
Playbook

Your session cookie is stealable

HttpOnly, Secure, and SameSite in plain English — what each flag stops, the exact settings to ship, and how to pick a SameSite value without logging your own users out.

Jul 6, 20265 min read

Don't wait for the blog to find out if you're a target.

Scan your site free →