The Decloak Journal
Security news &
platform updates.
Stories from around the web security world, plus release notes and changes to Decloak itself.
The Staging Subdomain You Forgot About Is Still Online (And Still Logged In)
Every domain accumulates subdomains nobody remembers: old staging environments, abandoned marketing pages, test deployments. Most were never meant to be public, and almost nobody audits them.
Your Production Site Might Be Shipping Its Own Source Code (And Not Telling You)
Source maps make debugging easier by linking minified code back to the original files. Left enabled in production, they hand an attacker your app's entire uncompiled source, comments and all.
The Security Header Almost Nobody Sets: What Content-Security-Policy Actually Does
Missing Content-Security-Policy headers show up in the vast majority of the sites we scan. Here's what CSP actually protects against, why it gets skipped, and how to add a working policy without breaking your site.
Why Your Supabase Database Might Be Publicly Readable (And How to Check in 30 Seconds)
Row Level Security is off by default in Supabase. That one setting is behind the most common security failure we see in AI-built apps - and it takes about 30 seconds to check whether yours is affected.