I write a lot of one-off recon scripts, but this one Nuclei template has survived every cleanup.
It's just a header check for missing security headers, but the value is in the diff — run it before and after a deploy, and you notice when a reverse proxy quietly drops Strict-Transport-Security.
id: missing-security-headers
info:
name: Missing security headers
severity: low
requests:
- method: GET
path:
- "{{BaseURL}}"
matchers:
- type: word
words: ["x-frame-options"]
negative: true
Small, boring, and it has caught real regressions.
Right now I'm digging into SQLite internals on the side — the B-tree page format is fascinating. Any favorite writeups?
Top comments (0)