Guide topic
Browser security, JWT and identity debugging, email authentication, transport controls, and safe validation workflows.
Application Security
Diagnose TLS certificate errors in order: confirm the exact SNI hostname, check SAN coverage and validity dates, inspect the chain presented by the server, then test whether the affected client's trust store can build a path to an accepted root.
Application Security
Verify every webhook before parsing or acting on it: preserve the exact request body, construct the provider-specific signed message, compute the documented HMAC, compare it safely, then enforce freshness and idempotency as separate controls.
Application Security
A JWKS kid mismatch means the verifier cannot select an acceptable public key for the token. Confirm the trusted issuer and algorithm, resolve its JWKS, refresh a stale cache once on a miss, and distinguish key-selection failures from signature and claim failures.
Web Development
CORS is a browser response-sharing policy. Debug the preflight request and response first, then verify the exact origin, method, headers, and credential mode rather than adding a wildcard everywhere.
Security
Someone sent you a QR code on Slack or email, but you are on your laptop. Learn how to decode QR code screenshots securely on Mac or Windows without needing your phone.
Application Security
Stop failing penetration tests. Use this practical production checklist for HTTP security headers, including HSTS, CSP, nosniff, Referrer-Policy, and what old headers you should remove.
Email & DNS Security
Passing SPF or DKIM does not mean your emails are secure. Learn the critical difference between email authentication and DMARC alignment, and why your emails still land in spam.
Application Security
Quishing (QR phishing) hides malicious links inside QR codes. Learn how the attack works, what payloads to watch for, and how to decode QR codes safely before executing them.
Application Security
Every photo you take can contain hidden EXIF metadata, including GPS coordinates, timestamps, and device details. Learn how to inspect and strip image metadata safely in your browser.
Application Security
Still using short, complex passwords with special characters? Learn why modern password guidance favors length, when passphrases make sense, and how to generate strong credentials safely.
Application Security
Whitelisting is dead. Learn how to implement a strict nonce-based Content Security Policy in Next.js and React without breaking hydration or third-party scripts.
Engineering
JWT exp, nbf, and iat use NumericDate seconds. Decode for diagnosis, but trust a token only after signature, issuer, audience, and time validation with an intentional clock-skew policy.