Отмечайте перед релизом, при отладке API и на ревью безопасности
Five minutes before deploy; catches most silly incidents
Not just "no browser warning" — the cert may expire in three days. Check days remaining first.
Открыть инструмент →At minimum HSTS, CSP and X-Content-Type-Options; missing ones show up in pentest reports.
Открыть инструмент →"Daily at 3" and "every 3 hours" are different expressions; check the next five run times.
Открыть инструмент →One-year caching on non-hashed filenames means users never get the new version.
A missing apex A record is the classic "only half the users can open it".
Открыть инструмент →Work through these in order — much faster than staring at the code
Decode the payload; exp is a second-level timestamp — compare with now.
Открыть инструмент →Backend returns seconds, frontend treats as ms — dates land in 1970 or the far future.
Открыть инструмент →Mixing URL-safe (-_) with standard (+/) variants fails silently on decode.
Открыть инструмент →Probe the path with JSON Path first, then write it into code.
Открыть инструмент →Paste both responses into the structural diff to see exactly which field differs.
Открыть инструмент →A raw & = # or space in a query truncates it into a different parameter.
Открыть инструмент →Most "low severity" scanner findings live here
HSTS needs includeSubDomains, or subdomains can still be downgraded.
Открыть инструмент →Credentialed endpoints reject "*" anyway; for public ones, decide whether anyone should call it.
Открыть инструмент →Syntax checks are not enough; validate resolved IPs too, or DNS can point at 127.0.0.1.
Открыть инструмент →Missing intermediates often work on desktop (cached) but fail on mobile.
Открыть инструмент →Using non-private ranges internally breaks broadly once VPN connects.
Открыть инструмент →