Cookies
Cookie security in 5 minutes: Secure, HttpOnly, SameSite
A session cookie is the key to a logged-in account. Three small flags decide whether that key is protected or up for grabs. Here is the five-minute version.
The VerifiedApp Blog
Web security, secret leaks, misconfigurations and how to earn trust — straight from the scanner team.
Security Headers
HSTS explained: why HTTPS alone is not enough
You have HTTPS — but the first plain-HTTP request is still a weak point. HSTS closes it by telling the browser to never speak HTTP to your site again.
Security Headers
Content-Security-Policy for people who do not write CSPs
CSP is the strongest defense against cross-site scripting — and the most misunderstood header. Here is what it actually does, minus the jargon.
Security Headers
What is a security header, and which ones actually matter?
Security headers are short instructions your server sends with every page, telling the browser to switch on protections. Most sites are missing several. Here is the shortlist.
Exposed Files
Source maps in production: shipping your source code by accident
Source maps make minified code debuggable by mapping it back to the original. Ship them to production and you have effectively published your source code.
Exposed Files
Your .git folder is public — and that is a full source-code download
If /.git is reachable on your site, an attacker can rebuild your whole repository — code, history and any secrets you ever committed. Here is how to check.
Exposed Files
.env exposed: how a single file hands attackers your whole stack
The .env file holds your database URLs, API keys and tokens. It belongs on the server — but when it ships to a public folder, anyone can just download it.
Secrets
The most common way API keys leak from production sites
API keys do not usually leak through clever hacks. They leak because a key meant for the server ends up in code the browser downloads. Here is the pattern, and the fix.
Vibe Coding
I shipped an app with AI in a weekend — here is what the scanner found
We built a small app the vibe-coding way, deployed it, then scanned it. Here is the honest list of what came back, and what each finding actually meant.
Vibe Coding
Security for vibe coders: the 7 things AI-generated apps leak first
AI writes the code that solves your prompt — not the code that keeps secrets. Here are the 7 things vibe-coded apps leak first, and how to catch them before bots do.
Trust
The trust badge, explained: how a security scan becomes a sales asset
Security work is invisible — you fix things and nobody sees it. A trust badge makes a clean site provable, and turns security into something that helps you sell.
Concepts
What does an automated website security scan actually check?
Automated scans are not magic. They check a defined list of things an attacker can see from outside. Here are the eight categories, and what each one means.