リリース前・API 調査・セキュリティレビューで一つずつ確認
Five minutes before deploy; catches most silly incidents
Not just "no browser warning" — the cert may expire in three days. Check days remaining first.
ツールを開く →At minimum HSTS, CSP and X-Content-Type-Options; missing ones show up in pentest reports.
ツールを開く →"Daily at 3" and "every 3 hours" are different expressions; check the next five run times.
ツールを開く →One-year caching on non-hashed filenames means users never get the new version.
A missing apex A record is the classic "only half the users can open it".
ツールを開く →Work through these in order — much faster than staring at the code
Decode the payload; exp is a second-level timestamp — compare with now.
ツールを開く →Backend returns seconds, frontend treats as ms — dates land in 1970 or the far future.
ツールを開く →Mixing URL-safe (-_) with standard (+/) variants fails silently on decode.
ツールを開く →Probe the path with JSON Path first, then write it into code.
ツールを開く →Paste both responses into the structural diff to see exactly which field differs.
ツールを開く →A raw & = # or space in a query truncates it into a different parameter.
ツールを開く →Most "low severity" scanner findings live here
HSTS needs includeSubDomains, or subdomains can still be downgraded.
ツールを開く →Credentialed endpoints reject "*" anyway; for public ones, decide whether anyone should call it.
ツールを開く →Syntax checks are not enough; validate resolved IPs too, or DNS can point at 127.0.0.1.
ツールを開く →Missing intermediates often work on desktop (cached) but fail on mobile.
ツールを開く →Using non-private ranges internally breaks broadly once VPN connects.
ツールを開く →