#http

Security and privacy, in practice

RFC 9116 answers the one question a stranger needs answered about your site: who do I tell about a vulnerability. What the file must contain, why the expiry date belongs in a test, and the routing trap that makes an SPA host serve it as HTML at 200.

• #security
• #http
• #spring-boot

Security and privacy, in practice

The cheapest security win on a single-container stack lives at the reverse proxy. Here's the four-header Traefik middleware I shipped, the two things I deliberately held back, and the report-only CSP rollout I'm lining up next.

• #csp
• #security
• #devops
• #traefik
• #http