ZeriFlow Journal
Actionable articles on TLS, headers, CSP, privacy, and practical hardening for modern web apps.
Categories
Tags
Cross-site scripting remains one of the most exploited vulnerabilities on the web. This guide covers all three XSS variants, vulnerable vs. secure code patterns, CSP as a second line of defense, and practical testing workflows.
Most websites start their first security scan between 50 and 65 out of 100. Getting to 90+ is achievable in a single day if you know which fixes have the highest point impact. This guide walks through every major scoring category, the typical point cost of each failure, and the exact fix for each.
Your GitHub repository is an attack surface — vulnerable dependencies, hardcoded secrets, and insecure code patterns all live there before they reach production. This guide covers every tool available for GitHub repository security scanning, from built-in features to advanced external tools.
Hardcoded API keys in source code are one of the most common and costly security mistakes in software development. This guide shows you how to find them with grep and automated tools, remove them from git history, and prevent them from appearing again.
A website security audit does not need to be expensive or time-consuming if you follow a structured process. This step-by-step guide walks through everything from scope definition to remediation tracking, with the right tools for each phase.
Missing email authentication records are one of the most common findings on security audits and the primary reason domains get spoofed for phishing. Setting up SPF, DKIM, and DMARC takes under an hour and dramatically reduces the risk of your domain being used in attacks.
Using a wildcard CORS policy is one of the most common security mistakes in Node.js APIs. This guide explains what CORS actually does, why * is dangerous when paired with credentials, and how to configure a secure origin allowlist.
Insecure cookies are one of the most common and exploitable misconfigurations in Node.js web applications. Understanding and correctly setting HttpOnly, Secure, and SameSite is non-negotiable for any session-handling application.
Content Security Policy is the most powerful XSS defense available, but it is also the header most likely to break third-party integrations. This guide shows you how to build a strict CSP in Next.js that works with Stripe, Google Analytics, fonts, and more.