Secrets
Google API keys & GCP service-account JSON in the open
A Google API key and a GCP service-account JSON file are not the same risk. One can be locked down; the other is a master key to your cloud project. Both leak the same way.
The VerifiedApp Blog
Web security, secret leaks, misconfigurations and how to earn trust — straight from the scanner team.
Exposed Files
Exposed SQL dumps: your database, downloadable
A database backup is just a file. Drop it in the wrong folder and your whole database — users, hashes, everything — becomes a single download away for anyone who tries the URL.
Security Headers
Mixed content: the HTTPS padlock that is lying to your users
Your page loads over HTTPS, the padlock shows, everything looks secure. Then one script loads over plain HTTP — and the secure channel you paid for has a hole in it.
Vibe Coding
Environment variables done right (and where they leak)
Env vars are how you keep secrets out of your code — until a build tool bakes them into the frontend bundle. Here is the part that actually decides whether they stay private.
Concepts
HTTPS vs. SSL vs. TLS: the terms, untangled
People say SSL, TLS and HTTPS as if they are the same thing. They are related but distinct — and one of them has been retired for years. Here is the clean version.
Cookies
SameSite cookies and CSRF: what None, Lax and Strict really do
SameSite is one word on your cookie that decides whether the browser sends it on requests coming from other sites. Get it wrong and you open the door to CSRF.
Secrets
Slack & Discord webhooks: the 'harmless' URLs that are not
A webhook URL feels like just a link, so it ends up committed and shipped to the browser. But that link is the credential — whoever holds it can post into your channel.
TLS/SSL
Your SSL certificate is expiring: automate it before it bites
An expired certificate does not degrade quietly — it slams up a full-page browser warning that stops visitors cold. The fix is to stop renewing by hand and automate it.
Supply Chain
The qix compromise (Sept 2025): how 2.6 billion weekly downloads got hit
One phishing email reached one maintainer, and malicious versions of packages with billions of weekly downloads went live. Here is the story and the practical lesson for your own builds.
Trust
B2B buyers check your security — make it visible
Before a B2B buyer commits, someone on their side is sizing up whether your site is safe to depend on — usually without telling you. Make the answer visible before they have to ask.
Security Headers
Subresource Integrity (SRI): trusting the CDN you do not control
When you load a script from a CDN, you are trusting that server to send the exact file you expect. Subresource Integrity makes the browser verify it instead of taking it on faith.
Secrets
Database connection strings in the open: Postgres, MySQL, MongoDB
A connection string is a username, password, host and database name in one line — the keys to your entire database. Here is how they get exposed and how to keep them private.