151 security guides
Practical, source-backed guides on securing real deployments: pre-launch checklists, exposed secrets, security headers, and platform-specific misconfigurations.
Learn how to schedule Decloak scans via the REST API, compare results across runs, and push new or regressed findings to Jira or Linear automatically.
Decloak’s free and paid scans generate evidence packages and framework mappings that satisfy SOC 2 and ISO 27001 auditors quickly and automatically.
Use Decloak’s free 15 - second scan to detect hard - coded keys, outdated libraries, missing SRI and mixed content in a single - page app before a formal audit.
Learn concrete steps to add, test, and harden a Content - Security - Policy header, from server configuration to iterative reporting and verification.
HTTP 1.1 is not a direct vulnerability, but its plain - text design and parsing ambiguities can create attack surfaces that need mitigation, especially when not used over TLS.
JavaScript can be a major attack surface because injected scripts run with the same privileges as the page, but proper sanitization, CSP, and safe frameworks eliminate most risks.
Cross - site scripting (XSS) lets attackers run malicious code in a victim’s browser by injecting untrusted data into web pages. Learn the three XSS types, how they work, and concrete steps to protect your site.
Learn what Snyk's security headers test checks, how grades are calculated, and why you should supplement it with Decloak’s broader web security scanning.
XSS lets attackers run arbitrary JavaScript in a victim’s browser, leading to session hijacking, data theft, credential harvesting, defacement, malware delivery, and business fallout.
Reflected XSS is a non - persistent cross - site scripting flaw that runs instantly in the victim’s browser and never stores data on the server. Learn how it works and how to defend against it.
Access-Control-Allow-Origin is a CORS response header that tells browsers which origins may read a resource, protecting against unauthorized cross - site data exposure.
Learn the exact rules for Access-Control-Allow-Credentials, why it must be paired with a specific origin, and concrete steps to configure it safely.
Learn which security headers matter, how to configure them correctly, and how Decloak’s free scan can verify your implementation in seconds.
Learn the core differences between XSS and SQL injection, see concrete mitigation steps, and discover how Decloak’s free web security scan can surface both issues.
Learn what security headers are, which ones matter most, how to add them to your server, and how Decloak’s free scan can validate their correct implementation.
Learn concrete steps to stop XSS attacks, from proper input handling to using Content - Security - Policy, and see how Decloak’s free scan can verify your defenses.
An authentication header is the HTTP request header that carries client credentials, typically the Authorization header, to prove identity to a server.
Learn the exact OWASP - recommended HTTP response headers, why each matters, and step - by - step how to add them to common web servers.
Missing HTTP security headers leave browsers vulnerable to downgrade, XSS, click - jacking and data leakage. This guide shows the essential headers, why they matter, and exact configuration examples.
Content Security Policy (CSP) in Chrome is the browser's built - in mechanism for declaring trusted sources and blocking unapproved content, helping prevent XSS and other injection attacks.
Without a CSP header, browsers allow any script to run, letting attackers execute malicious JavaScript via XSS or compromised libraries.
Learn step - by - step how to add a CSP header, choose directives, use nonces or hashes, and test with report - only mode to protect your site from XSS and related attacks.
CORS stands for Cross - Origin Resource Sharing, a browser security feature that controls how web resources are shared across different origins.
Same - origin policy blocks cross - origin reads by default, while CORS lets a server opt - in to share resources with selected origins via HTTP headers.
CORS lets a server tell browsers which origins may read its resources, enabling secure cross - origin requests while preserving the same - origin policy.
The "blocked by CORS policy" message appears when a browser stops a cross - origin request because the server did not send the required CORS headers.
Access-Control-Allow-Origin (ACAO) tells browsers which origins can read a cross - origin response. Learn the header values, credential rules, and caching tips to avoid CORS errors.
CORS cannot be removed; you must configure server headers, use a same - origin proxy, or apply temporary developer work - arounds.
The Access-Control-Allow-Origin header controls which origins can read a response. Use a single explicit origin, avoid wildcards with credentials, and add Vary: Origin for caching.
Learn what Windsurf AI code editor IDE is, how it improves developer productivity, and the security measures built into the platform.
Free security scan
Decloak's free scan runs in about 15 seconds, no account required, and covers: