For the last month or two, I've seen roughly ten times more vulnerability-scanning activity in my logs than usual. The increase started almost simultaneously across several different domains,…
I visited a legitimate website and entered my login details while it was using HTTPS. Shortly afterward, Safari displayed a "connection not secure" warning, and I noticed my…
During popular event sales, our site can receive tens of millions of requests. The current waiting room helps control the crowd, but bots and scalpers still occupy queue…
Over the past month or two, I've noticed roughly ten times more vulnerability-scanning activity in my server logs than usual. The increase started fairly suddenly and is happening…
During popular event sales, our site can receive tens of millions of requests. The current waiting room controls crowds but does not stop scalpers from taking queue positions,…
I'm new to web security and recently deployed my first small website through Netlify. It's only a static HTML, CSS, and JavaScript project, without a backend or anything…
I'm new to web development and recently deployed my first small static site using HTML, CSS, and JavaScript. I'm learning about observability and noticed 12 requests from what…
I'm researching how browser cookies are stored physically on a computer. For example, I've read that Chrome keeps cookies in an SQLite database and may encrypt some of…
I'm developing info.client.com, which is hosted on the client's Apache server. The client's main site, www.client.com, is hosted by a third-party service and embeds info.client.com in an iframe.…
I'm developing info.client.com, which needs to be embedded in an iframe on www.client.com. The main site is hosted by a third-party platform, while the embedded site runs on…
An analytics vendor released an update last week, and we only noticed a behavioral change after a user reported something unusual. That made us realize we have no…
I'm trying to understand the security reasoning behind access and refresh tokens. If access tokens are intentionally short-lived to limit the damage from theft, doesn't a long-lived refresh…
Our production CSP reports have become frequent enough that I'm no longer treating them as purely security notifications. Adding an analytics script, payment widget, or third-party SDK can…
While testing a video preview link, I accidentally got a version where the social platform displayed the entire webpage inside the post instead of showing only the video…
I'm accepting SVG files as user image uploads for a website. SVGO sometimes removes colors, breaks gradients or masks, or produces an empty image, so I'm looking for…
I'm an IT professional at a small company that relies heavily on Microsoft 365 and SharePoint but has limited Azure experience. I want to host an interactive, static…
I've been reviewing CSRF and Content Security Policy guidance and noticed that many important protections are still opt-in. Often, newer security features are added to patch weaknesses in…
I'm middle-aged and deeply interested in technology and cybersecurity. I've spent time working with operating systems, including taking them apart and experimenting with them, and I currently use…
During an authorized security assessment of a government website, I noticed that the "Remember Me" login feature appeared to save a recoverable password in a client-side browser cookie.…
I'm experimenting with different CAPTCHA systems and want to measure how well they resist automated submissions. The form has a single field and uses an invisible CAPTCHA, and…