Vulnerability notes, site pentests and audits
Recent vulnerabilities in plain language, and how a website pentest and a security audit work for companies.
Ransomware and 3-2-1 copies: a restore beats a checkbox
Ransomware takes both production and the "rescue" if the copy sits in the same account. Meaning appears after a trial restore.
A mobile app MVP: how not to build too much
An MVP tests one path. The full backlog in the first build is not speed. It is a refusal of feedback.
Personal data on a site: forms, access and technical measures
A "name and phone" lead is already personal data. Legal text without measures on the site itself does little.
The first hours after a defacement
A foreign page on your domain is not a reason to roll straight back to yesterday's copy. Entry and traces come first.
A customer database leak: the order of actions
First stop the export and keep the traces. Do not invent the customer text and the notification deadlines without a lawyer.
MFA for admin panels: why SMS is a weak second factor
A site is more often opened with someone else's password than with a rare bug. An SMS code creates a feeling of protection that is easy to walk around.
A corporate portal: roles matter more than a pretty admin
Internal systems break on permissions. A role matrix at the start is cheaper than a rewrite after the first audit.
An admin action log: why you need it before an incident
Without a log, "that was not us" means nothing. You cannot see who exported the database or who installed a plugin.
The payment page: what you must not store and what you must not connect
A card number should not end up with the store. An extra script on the payment page should not see the fields.
Third-party scripts on a landing: speed, leads and extra eyes
A chat, a pixel and three analytics tools often see more than the ads need, and slow the same page.