Blog
Security evidence and practical repair guidance.
Read the coverage before you read the score
Decide when a configuration score is meaningful, why small reports show counts, and what to compare after a change.
Declared dependencies are not deployed-version proof
A manifest, a lockfile and a running application answer different questions. Use each without assuming a source edit reached production.
Website scan authorization: attestation, ownership and limits
Separate authority to request a scan, HTTPS file proof and the limits of Quick and Deep before you collect evidence.
From a repair statement to a comparable recheck
Use a before-and-after example to distinguish an asserted repair, a comparable observation and an inconclusive result.
A security header finding is a starting point
Use an annotated response to turn a script-policy observation into an application-specific change request with a clear test boundary.
What a website configuration scan can—and cannot—tell you
Read a response observation without turning an absent header or unassessed area into a verdict about your whole application.