Daily security tips

One short, practical check per day. RSS feed.

• Are your "hidden" source maps still public? (2026-11-01)
  Hiding the comment that points to a source map does not remove the .map file. A one-line curl check, and how to make sure maps never ship.
• Is RLS on, but one policy lets everyone read? (2026-10-31)
  Turning on Row Level Security is only half the job. A policy written as using (true) opens the table to anyone holding your public anon key.
• Is an old API key still sitting in your git history? (2026-10-30)
  Deleting a key from your code does not delete it from git. If the repo is public, or ever was, the old commit still holds it.
• Is your login check only in the frontend? (2026-10-29)
  Hiding a page or button is not access control. If your API trusts whoever calls it, anyone can skip your UI.
• Is your site missing basic security headers? (2026-10-26)
  A few response headers stop clickjacking, downgrade attacks and some injected scripts. Here is how to check yours in a minute.
• Can anyone download your .env or .git folder? (2026-10-25)
  If your server hands out /.env or /.git/, your secret keys and code history go with it. A one-minute check and fix.
• Are your source maps shipping your whole codebase? (2026-10-24)
  Public .map files let anyone read your original source, comments and all. Here is how to check and turn them off.