Tagged: security

What Is Log Sanitization? Why It Matters and How to Do It

Logs capture more than errors - they capture whatever was nearby when something went wrong, including data that should never leave your system.

How to Remove Sensitive Data from Logs: A Step-by-Step Guide

Before a log leaves your hands - into a ticket, a chat, or an AI prompt - here's exactly what to check for and how to clean it.

JWT Explained: How JSON Web Tokens Work

A JWT packs identity claims into a compact, URL-safe string. Here's how the three parts fit together and what to watch for.

How to Sanitize Logs: A Practical Guide to Removing Sensitive Data

Logs pick up more than error messages - here's a practical process for cleaning them before they leave your hands.

What Sensitive Data Should Never Be Stored in Logs?

A checklist of exactly what shouldn't appear in your logs, and why each item on it is riskier than it looks.

How to Remove API Keys, Tokens and Passwords from Logs

Credentials in logs are the highest-stakes category to catch. Here's what to look for and how to redact it correctly.

Log Redaction vs Log Masking: What's the Difference?

"Remove the sensitive part" can mean several different things - here's how redaction, masking, hashing, and tokenization differ.

HTTP Security Headers Explained: A Practical Developer Guide

A handful of response headers tell the browser how to defend the page they came with. Here's what each one actually does.

Content-Security-Policy (CSP) Explained With Examples

CSP is an allow-list for where your page's resources can load from. Here's how the directives fit together.

What Is HSTS? Strict-Transport-Security Explained

HSTS closes a narrow but real window for downgrade attacks. Here's exactly what it enforces and how to configure it.

CORS Explained: Access-Control-Allow-Origin, Credentials and Common Mistakes

CORS is a browser-enforced exception to the same-origin policy. Here's how it works and the one combination that goes wrong constantly.

How to Fix Common Content-Security-Policy Errors

Read the console message, find the directive, then choose the safest fix: move, nonce, hash, or allow a specific host.

How to Secure HTTP Response Headers: A Practical Checklist

The headers worth setting, safe starting values, how to configure them on Apache and Nginx, and which old ones to leave behind.

How to Detect Email Header Spoofing

Technical indicators of spoofed headers, and why none of them is proof on its own.

How to Investigate Suspicious Emails Using Headers

A calm, step-by-step workflow for reviewing a suspicious message's headers.