Security guides
Clear technical reading for browser privacy, networks, web security and cryptography.
Latest guides
54 articlesTwo IP checks disagree. Which connection did each one measure?
Compare IPv4, dual-stack requests and VPN changes using a small connection record instead of an unexplained screenshot.
The extra address in a WebRTC result: a practical investigation
Read ICE candidate types, mDNS names and STUN observations before deciding whether a call followed an unexpected route.
A website works but its email fails: follow the DNS evidence
Separate website records, mail routing and resolver caches when a domain behaves differently across services.
Your homepage headers pass. What happens on a redirect or an error?
Build a small response matrix that tests security policies across the routes and status codes users actually receive.
A readable JWT payload is not an accepted login token
Build a verification decision from a trusted key, expected issuer and audience, expiry and the algorithm policy.
Will these IPv4 hosts fit? Check the boundary before the address count
Use subnet boundaries and reserved endpoints to decide whether a proposed network range can hold the intended devices.
One IPv6 address, two spellings: compare the bytes and the prefix
Recognise equivalent IPv6 notation and distinguish address scope from evidence of an actual internet connection.
The canvas hash changed. Design an experiment that can explain it
Control rendering inputs and browser conditions so a changed canvas digest produces an interpretable comparison.
Missing WebGL renderer details: privacy setting or rendering problem?
Use context creation, exposed limits and masked renderer information to separate graphics failures from restricted reporting.
An offline audio digest measures computation, not microphone access
Understand the controlled audio graph and its repeatability without mistaking it for a recording of your surroundings.
Why a browser permission works on one page and fails in an iframe
Check origin, secure context and embedding policy before treating a permission result as a whole-browser setting.
GPC is enabled. What did the browser communicate, and to whom?
Inspect exposed GPC and DNT preferences while separating a browser signal from a website's handling of the request.
The phone keyboard hid your button. Measure the visual viewport
Compare layout and visual viewport dimensions when zoom, browser chrome or an on-screen keyboard changes the usable area.
The API exists. Can this page actually use it?
Go beyond property detection to inspect secure contexts, permissions and the result of a real API operation.
Your offline data fits today. Plan for the next failed write
Interpret storage estimates and persistence requests while designing recovery for quota changes and eviction.
A supported video type still fails: narrow down the playback layer
Separate container and codec checks from decoding, delivery and the real asset used by your player.
The date is correct but the display is wrong: isolate locale and timezone
Reproduce formatting bugs by recording the instant, locale, timezone and options used by the application.
A DNSSEC change broke resolution. Check the delegation first
Investigate DS, DNSKEY and resolver validation behaviour when a signed domain suddenly becomes unreachable.
Before adding a domain to a rule, inspect the exact hostname
Review Unicode labels, Punycode and URL boundaries so allowlists target the intended hostname.
A certificate renewal meets a CAA policy: prepare the issuer change
Check inherited CAA records, wildcard rules and intended certificate issuers before changing certificate providers.
Lowering a DNS TTL today does not clear yesterday's cache
Plan a cutover using the previous TTL, negative answers and the service overlap needed during propagation.
Follow one delivered email through SPF, DKIM and DMARC
Use message headers and DNS evidence to explain which sending identities passed authentication and aligned with From.
An SPF pass still leaves DMARC failing. Trace the sender identity
Separate SPF authorisation from From alignment, and examine DNS lookup limits when a record grows.
Before p=reject, find the legitimate email your policy would block
Use alignment evidence and aggregate reports to stage a DMARC policy change around real sending services.
A DKIM key exists in DNS. Does the message use that selector?
Connect a delivered signature to its selector, signing domain and published key before planning a rotation.
A valid certificate can still fail for the hostname you requested
Trace TLS errors through hostname matching, SNI, chain delivery and the time used by the verifier.
The forgotten subdomain in an HSTS rollout
Review subdomain readiness and recovery time before adding includeSubDomains or requesting preload.
A CSP nonce must change with the response, not with the deployment
Inspect nonce generation, caching and report-only observations while introducing CSP to a real application.
A login cookie is set but the next request omits it. Check the scope
Use Domain, Path, Secure and SameSite evidence to explain a session cookie that behaves differently across requests.
A campaign URL carries private details. Check what the referrer reveals
Compare full-URL, origin-only and omitted referrers for the navigation and subresource requests that matter.
The embed asks for a camera, but the parent page never delegated it
Trace feature delegation through the top-level header, iframe policy and user permission for embedded media.
OPTIONS succeeded. Why did the browser still reject the API response?
Inspect preflight and actual-response headers together for credentialed and cross-origin API requests.
The brand name is in the URL. Is it actually the destination host?
Inspect parsed hostnames, user information and encoded components before using a link in a domain decision.
An encoded query changed its meaning. Check which component you encoded
Work through ampersands, plus signs and percent escapes using the encoding operation appropriate to each URL component.
A CDN file changed and the browser blocked it. Recheck the SRI contract
Generate integrity values from exact served bytes and coordinate asset versions, HTML changes and cross-origin delivery.
A security.txt contact can parse correctly and still be unreachable
Check reporting destinations, expiry and published location so a security report has a usable path to an owner.
The download hash matches. Where did the expected value come from?
Separate a complete checksum comparison from the independent publisher evidence needed to trust a download.
Before encrypting your only copy, rehearse the recovery
Use a verified encryption and decryption round trip to plan password handling, backups and safe file replacement.
These strings look identical. Their UTF-8 bytes may differ
Inspect Unicode composition, line endings and exact input bytes when a text digest disagrees across systems.
The webhook JSON is equivalent, but its HMAC no longer matches
Verify the original request bytes and provider signing contract before parsing and reserialising a webhook body.
No breach match is evidence about a corpus, not a password guarantee
Understand range-query disclosure, known-corpus limits and the practical response to a matching password.
An unpredictable UUID is still an identifier, not access control
Check UUIDv4 version and randomness while keeping resource identifiers separate from authorisation decisions.
The password rule changed. Keep length, randomness and storage in the plan
Generate unique credentials around real service restrictions and a password-manager workflow.
A reset token needs a lifetime and a storage rule as well as random bytes
Plan entropy, encoding, verifier storage, single use and expiry for application tokens.
A HAR redaction can remove cookies and still leave account data behind
Review request URLs, headers and bodies while keeping enough evidence to reproduce a support issue.
The Base64 decoded, but the text did not. Inspect the bytes first
Separate Base64 alphabet and padding issues from UTF-8 decoding and the binary data represented by the input.
Hex pairs are bytes. Their meaning depends on the format
Check complete byte pairs, text encoding and endianness before interpreting hexadecimal input as data.
Valid JSON can still lose a number or hide a duplicate field
Review syntax separately from duplicate keys, numeric precision and the application schema.
A timestamp points to the wrong decade. Check seconds versus milliseconds
Identify epoch units and timezone presentation before changing a stored event time.
A browser snapshot helps compare environments, not name a person
Read measured browser fields and controlled changes without turning a matching digest into an identity claim.
After a VPN change, compare HTTP and WebRTC as separate routes
Build a repeatable before-and-after connection record that preserves protocols, address families and missing observations.
Introduce browser security policies around the flows you cannot break
Plan staged policy changes for login, embeds and third-party dependencies, with response-level verification.
Prepare a support HAR that explains the failure without exporting the account
Use disposable reproductions and application-specific redaction while preserving a useful network request sequence.
Checksum, encrypted file or breach query: choose the operation for the question
Distinguish byte integrity, confidentiality and known-password evidence with practical workflows for each tool.
No guides match that search.
54 guides