Vulnerability notes, site pentests and audits
Recent vulnerabilities in plain language, and how a website pentest and a security audit work for companies.
Passwords saved in the browser: convenient until the laptop is not yours
The browser remembers the admin panel, mail and the bank. A program the person ran themselves takes that memory whole. A spreadsheet is no better.
One password after someone else's breach: why "that is not us" fails
A leaked service's database is not picked apart for that service. It is used on your mail, admin panel and ads if the password matched.
A checklist before a site launch
The domain, the form, analytics, a copy and the admin. If this is not checked, launch day checks it on live people.
A lookalike domain and a fake site: the customer pays someone else
One character in the address, and an "invoice" letter looks like yours. Domain protection starts at the registrar, not with a banner that says "we never write first".
A QR code on an invoice, a counter and a badge: where it actually goes
A code in a letter and a sticker on top of your door code go to the same place: the person does not see the address until they have followed it.
A call that sounds like the director: what accounting should do
A voice can be built from a recording on the site and from a conference. Confirming a payment by the voice on the line is a weak rule.
A web studio's access to the site: convenient for them and for whoever comes next
A contractor with a permanent admin account is a common audit finding. Revoking access on the day the work ends matters more than arguing the contract afterwards.
An API key in the page source: everyone who opened the site can see it
A key that arrived in the browser is no longer a secret. It is used against your service in the site's name until you issue a new one and turn the old one off.
A password file left open on the site: what to do in the first hour
If a file with the database and mail passwords downloads from the site address, someone may already have taken it. Rotate the secrets first, then see who managed to sign in.
A test copy of the site on the internet: a forgotten address with live data
A dev or staging subdomain is often indexed, keeps an old password and a fresh customer database. To a search engine it is an ordinary page.