Vigil
Sign inStart free trial
All articles
Category

Security

Secrets, exposure and the defensive posture of the things you run for clients.

AllWordPressSecurityMonitoringDesign
Security5 min read

Keeping secrets write-only (and why you should)

A monitoring tool holding readable credentials is a breach waiting to happen. Ours can’t.

Security8 min read

The security headers every site should send — and how to set them

HSTS, CSP, nosniff, framing, Referrer-Policy, Permissions-Policy. What each one stops, and the exact lines to add for nginx, Apache and Node.

Security6 min read

Cookie flags that matter: Secure, HttpOnly, SameSite (and scope)

A session cookie without the right flags is a session waiting to be stolen. What Secure, HttpOnly and SameSite do — and how to set them on any stack.