Security

Security headers, secrets, and best practices

Security tools cover the surface area that automated scans tend to flag and that pre-launch checklists tend to miss: Content-Security-Policy builders with directive-by-directive explanations, HSTS / X-Frame-Options / Referrer-Policy header generators, JWT signature verifiers, password-strength testers with explanations of which character class is missing, .env-file leaks scanners that grep for accidentally-committed secret patterns. The bias is defensive — these tools help you ship secure-by-default, not exploit other systems. Useful both during pre-deploy security reviews and when an external scan flags a header issue you need to fix without re-architecting.