Security posts
Everything in the journal filed under security.
2026
Payment webhooks: signatures, replays and idempotency keys
Verify the signature over the raw body, reject old timestamps, store the event id, never trust the amount. A compact handler and the checks around it.
2025
Self hosted fonts, privacy law and one request less
A hosted font stylesheet hands every visitor IP address to another company before your page renders. Self hosting removes the transfer and a round trip.
The rsync flag that breaks certificate renewal
A mirroring deploy removes everything the build did not create, including the path a certificate authority reads. How to catch it weeks before the expiry.
How a misconfigured root exposes your .env to the internet
When the web root points at the project directory and the server falls back to any file that exists, your .env and .git are one plain request away.
A strict content security policy with an inline first paint
Inlining critical CSS and a small script is good for first paint and illegal under a strict CSP. Hashes fix it, if you compute them at the right moment.
2024
The nginx rule that quietly drops your security headers
In nginx, add_header is only inherited when the child level defines none of its own. One cache header in a location removes HSTS and nosniff from it.