Vor dem Deploy, beim API-Debugging oder im Security-Review Punkt für Punkt abhaken
Five minutes before deploy; catches most silly incidents
Not just "no browser warning" — the cert may expire in three days. Check days remaining first.
Tool öffnen →At minimum HSTS, CSP and X-Content-Type-Options; missing ones show up in pentest reports.
Tool öffnen →"Daily at 3" and "every 3 hours" are different expressions; check the next five run times.
Tool öffnen →One-year caching on non-hashed filenames means users never get the new version.
A missing apex A record is the classic "only half the users can open it".
Tool öffnen →Work through these in order — much faster than staring at the code
Decode the payload; exp is a second-level timestamp — compare with now.
Tool öffnen →Backend returns seconds, frontend treats as ms — dates land in 1970 or the far future.
Tool öffnen →Mixing URL-safe (-_) with standard (+/) variants fails silently on decode.
Tool öffnen →Probe the path with JSON Path first, then write it into code.
Tool öffnen →Paste both responses into the structural diff to see exactly which field differs.
Tool öffnen →A raw & = # or space in a query truncates it into a different parameter.
Tool öffnen →Most "low severity" scanner findings live here
HSTS needs includeSubDomains, or subdomains can still be downgraded.
Tool öffnen →Credentialed endpoints reject "*" anyway; for public ones, decide whether anyone should call it.
Tool öffnen →Syntax checks are not enough; validate resolved IPs too, or DNS can point at 127.0.0.1.
Tool öffnen →Missing intermediates often work on desktop (cached) but fail on mobile.
Tool öffnen →Using non-private ranges internally breaks broadly once VPN connects.
Tool öffnen →