TLS/SSL
Your SSL certificate is expiring: automate it before it bites
An expired certificate does not degrade quietly — it slams up a full-page browser warning that stops visitors cold. The fix is to stop renewing by hand and automate it.
The VerifiedApp Blog
Web security, secret leaks, misconfigurations and how to earn trust — straight from the scanner team.
Supply Chain
The qix compromise (Sept 2025): how 2.6 billion weekly downloads got hit
One phishing email reached one maintainer, and malicious versions of packages with billions of weekly downloads went live. Here is the story and the practical lesson for your own builds.
Trust
B2B buyers check your security — make it visible
Before a B2B buyer commits, someone on their side is sizing up whether your site is safe to depend on — usually without telling you. Make the answer visible before they have to ask.
Security Headers
Subresource Integrity (SRI): trusting the CDN you do not control
When you load a script from a CDN, you are trusting that server to send the exact file you expect. Subresource Integrity makes the browser verify it instead of taking it on faith.
Secrets
Database connection strings in the open: Postgres, MySQL, MongoDB
A connection string is a username, password, host and database name in one line — the keys to your entire database. Here is how they get exposed and how to keep them private.
Vibe Coding
A security review for AI-generated code: a practical checklist
AI tools get you to a working app fast. They optimise for 'it runs', not 'it is safe to expose'. Here is a short, concrete review to run before you ship.
Exposed Files
phpinfo() and server-status: the debug pages attackers grep for
A forgotten phpinfo.php or an open server-status page is a free reconnaissance gift. Bots request them by name on every site. Here is what they reveal and how to close them.
Security Headers
Referrer-Policy: stop leaking your URLs to third parties
Every time a user leaves your page, the browser can tell the next site exactly which URL they came from — query strings and all. Referrer-Policy decides how much of that you give away.
CORS
CORS with credentials and a wildcard: the worst combination
CORS is supposed to protect your API from other websites. Combine a wildcard origin with credentials and you do the opposite — you invite them in. Here is the fix.
TLS/SSL
Forward secrecy (PFS): the cipher property that protects past traffic
If your private key is ever stolen, forward secrecy decides whether attackers can read only future traffic or every conversation you have ever had. Here is how it works.
Secrets
GitHub tokens explained: PAT classic, fine-grained, OAuth — and their blast radius
All three are 'a GitHub token,' but a leaked one can mean very different things — from a single repo to your entire account. The difference is scope.
Concepts
What is a CVE, and how do you know if you are affected?
You keep seeing CVE-2024-something in advisories and dependency warnings. Here is what that ID actually is — and the more useful question of whether it touches you.