#security
5 pieces filed under “security”.
Auth for content and commerce: passkeys, magic links, and the recovery flow
Passkeys, magic links, or passwords with rules? How we choose auth for content and commerce sites — and the account-recovery flows everyone forgets to design.
CSP without the tears: a security baseline for content sites
A copy-paste security headers baseline for content sites: Content-Security-Policy with nonces, report-only rollout, and the headers nobody checks until audit.
Auditing third-party scripts before they audit you
Third-party scripts are a governed supply chain, not a paste bin. Our audit method: measure the cost, gate on consent, fence with CSP, and assign every tag an owner.
Dependency hygiene: the boring audit that saves the launch
Client codebases rot at the package.json line. Audit cadences, update windows, vendoring decisions, and the licence review nobody does until procurement asks.
Supply-chain security for JS teams (without the panic)
A calm, runnable supply-chain security practice for JS teams: lockfile hygiene, dependency cadence, audit triage and provenance — no fear-mongering.