Guides

Practical answers for small software teams: what is public about your app, what to do when something goes wrong, and how to answer a customer's security review.

What's public about your app

• How to find every public subdomain of your domain, and what to do about forgotten onesFind forgotten staging, admin and preview subdomains with certificate transparency, crt.sh and subfinder, then check them for takeover.

Customer security reviews

• A customer asked for your pen test report and you don't have one. What now?Got a security questionnaire asking for a pen test report you don't have? What to answer, what to send instead, what a test costs, and what SOC 2 requires.

After an incident

• After Railway's October 2026 security incident: what to rotate and checkRailway says env vars may have been decrypted Oct 20-22, 2026. Which keys to rotate first, where to check usage logs, and how to close public DB access.