Field notes

Security, without the noise

What a real audit finds, why scanners drown you, and the handful of things that actually get companies breached.

Guides · What does a penetration test cost in 2026?

scannersfalse-positivesmethodologysupabaserlsapi-securityheaderscsphardeningjwtauthenticationattack-chainenv-leakrecon

Why Your Scanner Lies: What 800 Findings Actually Means

Raw scanners flag by pattern and version, not by proof. Here is the false-positive tax and what 'verified with evidence' actually means.

A public anon key plus missing Row Level Security lets anyone read or delete real user data. How to test /rest/v1 without breaking anything.

CSP, HSTS, nosniff, frame-ancestors: what each header really buys you, which ones are cargo cult, and how to prioritize without breaking your app.

A leaked JWT signing secret lets anyone mint an admin token. The chain from leak to forge to privileged endpoint, proven without touching data.

How one forgotten dev server leaks your JWT secret, database creds, and cloud keys, plus the exact kill-chain that follows.

The free scorecard grades your site in under a minute — sign in free and see for yourself.