Website Security articles and guides from the kant.au team.
Every page a browser loads can, by default, be asked to hand a visitor’s camera, microphone, or location to any script running on it, including scripts your site didn’t write and doesn’t control. Almost nobody explicitly closes that door. What Permissions-Policy actually controls Permissions-Policy is a response header that declares which browser features and APIs […]
Read more →
A subdomain takeover doesn’t require breaching anything. No password to guess, no server to compromise. It just needs a DNS record nobody remembered to delete, pointing at a service nobody’s paying for anymore. The example below is a composite walkthrough, not a specific real domain we found and are naming. The pattern itself is extremely […]
Read more →
The browser doesn’t give a warning. It gives a red screen. “Your connection is not private.” Most visitors leave immediately, and a percentage never come back. For the people managing the site, it’s always a surprise. It shouldn’t be. What SSL certificates actually do An SSL certificate encrypts the connection between a browser and a […]
Read more →