Read your security headers in one command
Five response headers do most of the browser-side hardening work, and you can see all of them with curl. Here's what to run, what each one does, and what to set if it's missing.
Topic
How-to
How-to
More on How-to
How-to
How-to
How-to
How-to
How-to
← All posts
Check an npm package before you install it
Installing a package runs its code. So the thirty seconds you spend looking at it beforehand are the only thirty seconds where you're still in control. Here's what I actually check, and the commands for each.
Who still has access to your accounts?
Changing your password doesn't sign anyone out, and it does nothing to the apps you connected in 2019. Here are the exact pages to check, and the order to check them in.
Where does this link actually go? Check without clicking
Short links hide the destination, and that's the point of them. One curl command tells you where a link lands before you commit to going there, and there's a version for people who don't live in a terminal.
Find the secrets already in your git history
Deleting a key from a file doesn't remove it from the repo. It's still sitting in an old commit, and anyone who can clone can read it. Here's how to find what's in there, and why rewriting history is the wrong first move.
Can someone send email as your domain? Two commands will tell you
Most domains are still wide open to spoofing, and the owners have no idea. You can check yours in about thirty seconds with dig, and you don't need to be the person who runs the mail server to do it.