Latestinsights.
Security research, performance deep-dives and best practices for founders who build fast with AI and want to ship safely.
SPF, DKIM and DMARC: What Each One Actually Proves
Three records, three different claims — and only one of them protects the address your recipients actually see. A precise explanation of what each record proves, why SPF and DKIM are not enough on their own, and what alignment really means.
Can You Have Two DMARC Records? What Breaks When You Do
No — and the failure is worse than you would guess. Two DMARC records do not merge, do not take turns, and do not fall back to the stricter one. Receivers discard both, and the domain is left exactly as unprotected as if you had published nothing.
The Contact Address on Your Site Might Be Silently Bouncing
Sending email and receiving email are configured separately, and almost everyone only does the first. If your domain has no working MX record, every message a customer sends to the address in your footer bounces at their end — and nothing on your side ever tells you.
Your Cookie Banner Already Lost: Tracking That Fires Before Consent
A banner that appears after the analytics cookie is already set is not asking for consent — it is announcing a decision. Here is how to tell whether your trackers fire before the click, why the banner makes it worse rather than better, and what to actually change.
Never Trust the Browser for Price: Checkout Amount Tampering
A hidden field is not hidden — it is simply not drawn on screen. If your checkout sends the price from the browser, the price is whatever the customer decides. Here is how to tell whether yours does, and the server-side pattern that ends the problem.
What ~all, -all and ?all Actually Do in an SPF Record
The last few characters of your SPF record decide what happens to every server you did not list — which is to say, every server an attacker would use. Two of the four options mean "no policy at all", and one of them is the default when you leave the qualifier off.
From p=none to p=reject Without Losing Your Own Mail
A DMARC record at p=none protects nothing — it only reports. Moving to enforcement is straightforward and it is also the step where people break their own invoicing. Here is the ramp that gets you there without a surprise.
Does Your Privacy Policy Name the Tools Your Site Actually Loads?
Most privacy policies were written once, from a template, before half the current stack existed. Meanwhile the site loads analytics, a session recorder, a chat widget and a font CDN — each of which receives visitor data. Here is how to check the two against each other.
Your AI Coding Tool Left Its Notes on Your Server
A .cursorrules file, a CLAUDE.md, an MCP config with an API key in it — none of these are meant to be public, and all of them ship when you deploy a repository instead of a build. Here is how to check yours, in one command.
How to Prevent SQL Injection in AI-Generated Code
AI coding tools move fast — but they often generate SQL queries without parameterization. Learn how to detect and fix SQL injection vulnerabilities before they reach production.
The Security Risks of AI-Generated Code (And How to Audit Them)
Vibe-coded apps are shipping faster than ever — but they come with hidden security risks. We look at the most common vulnerabilities and how to audit for them.
AEO vs SEO: Why AI Visibility is the New Search Frontier
Answer Engine Optimization is reshaping how content surfaces in AI-powered search. Here's what you need to know to stay discoverable in a ChatGPT and Perplexity world.
Core Web Vitals: What Changed with INP, and How to Pass
Google's ranking signals keep evolving. Here's a practical breakdown of the latest CWV thresholds and how to optimize your Next.js app to hit green across the board.
Structured Data for LLMs: Schema.org in the Age of AI Search
Schema markup isn't just for Google anymore. Learn how to structure your content so large language models can accurately represent your product in AI-powered search.
Content Security Policy: A Practical Guide for SaaS Apps
A misconfigured CSP is as dangerous as having none at all. This guide walks through building a strict policy without breaking your third-party scripts or analytics.
WCAG 2.2: The Complete Developer's Guide
WCAG 2.2 introduced nine new success criteria. We break down each one, explain the real-world impact, and show you exactly what to fix in your codebase.
TLS Configuration Best Practices for Modern Web Apps
TLS 1.0 and 1.1 are formally deprecated. Here's what production-grade looks like for your protocol versions, certificate chain and HSTS header — and how to verify it from outside.
The DNS Checklist to Run Before You Point a Domain at Production
From SPF to DMARC, DNS misconfigurations can kill email deliverability and expose your domain to spoofing attacks. Run through this pre-launch DNS checklist.
10 Lighthouse Tricks That Actually Move the Needle
Stop chasing vanity scores. These ten targeted optimizations have the highest ROI for real-world Lighthouse performance improvements in React and Next.js apps.
Is Your robots.txt Accidentally Blocking Google?
A single misplaced Disallow directive can wipe your site from search results overnight. Here is how to audit and fix your robots.txt before it becomes a costly problem.
ARIA Labels: When to Use Them and When to Avoid Them
ARIA can make your app more accessible — or actively harm screen reader users if misapplied. This guide explains the rules with practical before-and-after examples.
Ready to ship with confidence?
Get your first launch readiness report today — free to start, no credit card required.
• Free scan to start
