https://www.xbcatm.com/series/web-security/Illustrated field notes on HTTP, DNS, TLS, Caddy, SSH, releases, and recovery.Hugoen-ushttps://www.xbcatm.com/notes/caa-records-should-authorize-the-issuer-you-actually-use/Sun, 23 Aug 2026 00:00:00 +0000https://www.xbcatm.com/notes/caa-records-should-authorize-the-issuer-you-actually-use/Inspect inherited CAA policy before restricting which certificate authorities may issue for a domain.https://www.xbcatm.com/notes/cookie-scope-should-be-narrower-than-the-application-boundary/Sun, 23 Aug 2026 00:00:00 +0000https://www.xbcatm.com/notes/cookie-scope-should-be-narrower-than-the-application-boundary/Review Domain, Path, Secure, HttpOnly, and SameSite as one browser storage contract.https://www.xbcatm.com/notes/hsts-should-be-rolled-out-with-a-recovery-plan/Sun, 23 Aug 2026 00:00:00 +0000https://www.xbcatm.com/notes/hsts-should-be-rolled-out-with-a-recovery-plan/Increase max-age only after HTTPS, redirects, and every covered subdomain are ready.https://www.xbcatm.com/notes/certificate-expiry-is-a-date-not-a-dashboard-color/Sat, 22 Aug 2026 00:00:00 +0000https://www.xbcatm.com/notes/certificate-expiry-is-a-date-not-a-dashboard-color/Check the certificate served for the real hostname and turn the remaining days into an actionable threshold.https://www.xbcatm.com/notes/security-headers-should-describe-the-actual-page/Sat, 22 Aug 2026 00:00:00 +0000https://www.xbcatm.com/notes/security-headers-should-describe-the-actual-page/A compact policy is safer when it matches the resources a static page really loads.https://www.xbcatm.com/notes/ssh-host-keys-are-part-of-the-deployment-record/Sat, 22 Aug 2026 00:00:00 +0000https://www.xbcatm.com/notes/ssh-host-keys-are-part-of-the-deployment-record/Keep first contact explicit and reject unexpected host-key changes.