Security guides
- How to find leaked API keys in your website's JavaScript (and fix them)
A practical guide to finding secret API keys exposed in client-side JavaScript, telling public keys from secret ones, and moving API calls to the server safely.
- Security headers explained: a practical setup for Next.js, Nginx and Caddy
What each HTTP security header does, sensible values to start with, and copy-paste configuration for Next.js, Nginx and Caddy, including a nonce-based Content-Security-Policy.