ZeriFlow Journal
Actionable articles on TLS, headers, CSP, privacy, and practical hardening for modern web apps.
Categories
Tags
Security headers are the fastest way to harden a Next.js application. This guide covers all seven essential headers with production-ready configuration for both App Router and Pages Router.
You do not need an enterprise budget to find serious security vulnerabilities on your website. These five free methods cover everything from TLS configuration to missing HTTP headers and vulnerable dependencies.
X-Frame-Options and CSP's frame-ancestors directive both prevent clickjacking by controlling how your page can be embedded in iframes. But they are not equivalent — one is a legacy header, the other is the modern standard. This guide explains the differences, which to use, and why you should set both.
TLS is the foundation of web security — but most developers configure it once and never look at it again. This guide covers the practical details: TLS 1.2 vs 1.3 differences, how to choose cipher suites, certificate validation mechanics, OCSP stapling, and the most common TLS misconfigurations that still show up in production.
Vulnerable npm packages are responsible for some of the most damaging supply chain attacks in recent years. This guide explains how CVEs get into your dependencies, how to use npm audit effectively, when upgrading is the right call, and how to automate security scanning so you're not caught off guard.
Hardcoded secrets — API keys, passwords, and tokens embedded directly in source code — are one of the most common causes of cloud infrastructure breaches. This guide explains the risks, shows you how to find them using automated tools, and walks through the correct remediation process including git history cleanup.
The OWASP Top 10 is the most widely referenced framework for web application security risks. This guide covers all ten vulnerabilities with real-world examples, concrete testing methods, and specific fixes — not abstract theory.
Most security incidents are caused by preventable configuration gaps, not sophisticated zero-day exploits. This 20-point checklist covers every layer of web application security that needs to be verified before you push to production, with brief explanations and remediation steps for each item.
HSTS (HTTP Strict Transport Security) is a single header that eliminates an entire class of SSL stripping attacks. This guide explains how it works, how to configure it safely, and what you must check before enabling the preload flag.