11 Sep 2026How to Score a Vulnerability with CVSS v3.1CVSS turns a vulnerability into a number that drives deadlines and audit findings. Here is what it measures, and what it deliberately ignores.Read article →BITCOPS learn
Security notes for practical work.
Human-reviewed educational content belongs here—threat modeling, secure development, and responsible analysis.
11 Sep 2026How to Score a Vulnerability with CVSS v3.1CVSS turns a vulnerability into a number that drives deadlines and audit findings. Here is what it measures, and what it deliberately ignores.Read article →
11 Sep 2026What a Public IP Address Reveals (and What It Does Not)An IP address gets treated as identification. The gap between what people assume and what is true is wide enough to cause real mistakes.Read article →
11 Sep 2026Subnetting Without the Headache: CIDR ExplainedSubnetting looks like arbitrary maths until you see what the slash actually means. No binary conversion tables required.Read article →
11 Sep 2026Reading DNS Records: A, CNAME, MX, TXT and the RestDNS is the layer everyone depends on and nobody looks at. Here is what each record type does, why TTL decides how long mistakes last, and what your records reveal.Read article →
11 Sep 2026Hashing Explained: What SHA-256 Is For (and What It Is Not)Hashing is not encryption, and SHA-256 is the wrong tool for passwords. Here is what hash functions are actually for and where people go wrong.Read article →
11 Sep 2026How to Generate Passwords You Can Actually TrustEvery generator produces something that looks random. Whether it is random depends on the source — and that difference is invisible in the output.Read article →
11 Sep 2026Password Entropy: Why Length Beats Complexity Every TimeThe uppercase-number-symbol rule came from a 2003 document its own author later apologised for. Here is what actually makes a password hard to crack.Read article →
11 Sep 2026Reading HTTP Status Codes and Redirect ChainsYour browser hides redirects. When a page will not rank or a login loop will not resolve, the hidden hops are usually where the answer is.Read article →
11 Sep 2026Secure, HttpOnly and SameSite: The Cookie Flags That Actually MatterA session cookie is a credential. Three attributes decide how well it is protected, and all three are one line of config. Here is what each one does.Read article →
11 Sep 2026CORS Explained: Why Your Request Is Blocked and How to Fix It SafelyIt works in Postman but fails in the browser — and the usual fix quietly disables the same-origin policy for your whole API. Here is what CORS is really doing.Read article →
11 Sep 2026Writing a Content-Security-Policy That Does Not Break Your SiteCSP is the best defence against XSS and the one most likely to break your site on day one. Here is how to deploy it in report-only mode first and avoid the unsafe-inline trap.Read article →
11 Sep 2026How to Read a TLS Certificate (and What Actually Expires)Everyone checks the Common Name. Browsers stopped caring about it years ago. Here is what a TLS certificate actually claims, and the three things worth checking.Read article →
11 Sep 2026URL Encoding: Percent-Encoding Without the GuessworkEveryone knows %20 is a space and almost nobody is sure about the rest. Get it wrong and you break a link — or introduce a filter bypass.Read article →
11 Sep 2026Base64 Is Not Encryption — What It Is Actually ForBase64 looks like encryption to anyone who has not met it before. That resemblance has caused a remarkable number of security incidents.Read article →
11 Sep 2026How to Decode a JWT — and What to Check Once You HaveA JWT is signed, not encrypted — anyone holding one can read it. Here is how to decode the three parts and what actually matters once you can see inside.Read article →
11 Sep 2026How to Read Email Headers (and Tell if a Message Was Spoofed)Every email carries a record of where it has been. Read the headers in the right order and a spoofed message usually gives itself away in about thirty seconds.Read article →
28 Aug 2026DMARC Explained: What p=none, quarantine and reject Actually DoDMARC is the part that actually stops domain spoofing — but only once you move past p=none. Here is what each policy does and how to get there safely.Read article →
25 Aug 2026DKIM Explained: How to Find, Read and Check a DKIM RecordDKIM is the only part of email authentication that survives forwarding. Here is how selectors work, how to find yours, and what the record actually contains.Read article →
25 Aug 2026What Is an SPF Record? How to Read and Fix YoursSPF is a single line of DNS text that decides whether your email looks legitimate. Most broken records fail for the same three reasons — here is how to read yours and fix it.Read article →
25 Aug 2026HTTP Security Headers Explained: What They Do and How to Read Your OwnHTTP security headers are the cheapest hardening available: no code changes, just a few lines of server config. Here is what each one does, what a sensible baseline looks like, and what they cannot protect you from.Read article →