Burp Suite vs OWASP ZAP: Which Web App Scanner Fits Your Workflow
Both can find the same categories of web vulnerabilities. The real difference is workflow: one is built around a commercial tester's manual process, …
All articles
Every FirewallSync article, newest first.
Content Security Policy: A Strict Nonce-Based Policy and How to Roll It Out Safely
A Content Security Policy limits what scripts a browser will run, which can turn a cross-site scripting bug from a full compromise into a blocked …
SPF, DKIM and DMARC: What Each Record Does and What Gmail and Outlook Require
SPF, DKIM and DMARC answer three different questions about a message. Here is what each record checks, how alignment ties them together, what Google …
Open Source vs Commercial SIEM: What Actually Changes at Small Scale
The license cost is the easiest number to compare and the least representative of the real cost. What actually differs at small scale is who's doing …
AWS IAM Least Privilege: A Practical Guide to Finding Excess Permissions
Least privilege fails in practice because most teams have no visibility into which granted permissions are actually used. Here's how to find the gap …
What Is Token Theft and Why MFA Doesn't Always Stop It?
MFA verifies who's logging in, not who's still using the session afterward. Token theft attacks steal what MFA leaves behind: the authenticated …
1Password vs Bitwarden vs Vaultwarden: Choosing a Password Manager for a Small Team
The real decision isn't which one has more features. It's how much operational responsibility your team is willing to take on in exchange for lower …
S3 Block Public Access: What the Four Settings Do and How to Enforce Them
New S3 buckets have blocked public access by default since April 2023, but older buckets, account settings and new accounts can still be open. Here is …
CORS Misconfiguration: What Access-Control-Allow-Origin Actually Permits
A CORS header decides which other websites may read your responses with your users' cookies attached. Reflecting the Origin header, matching it with …
What Is PII, and Why Classification Is Harder Than It Sounds
PII sounds like it should be a simple list of field names to check for. In practice, whether something counts depends on context, combination with …
How to Secure OAuth Tokens in Production
Most OAuth implementations follow the happy-path tutorial and skip the parts of the spec that exist specifically to stop token theft. Here's what the …
CSRF Protection: SameSite Cookies, Tokens and Fetch Metadata Compared
SameSite cookies reduce cross-site request forgery but do not end it. Here is what each defense stops, where each one fails, and a header check you …