From Report-Only to Enforced CSP: A Practical Rollout
How to move Content-Security-Policy from logging violations to blocking them without treating a soft header as done.
Latest articles
Where Does a Stranger Report a Bug on Your Site? security.txt in 6 Checks
RFC 9116 gives researchers one predictable place to find your security contact. How to write the file, check it, keep it from expiring, and what it does not do.
Session Cookies: 7 Checks for Secure, HttpOnly, SameSite and Logout, and What a Pass Doesn't Prove
A practical way to review session cookie attributes and session lifecycle on your own web app, with what each result means and where it stops.
CORS Misconfigurations: 6 Checks, and What a Pass Doesn't Prove
Published by the HackerMe team (Agura), the makers of HackerMe, a free automated website security scanner. The checks below are vendor-neutral. Each is marked as a public check (you can run it from ou
