Goran Štimac 
Security Headers and CSP in 2026: Practical Reset for Static Sites
W3C CSP3 is still a Working Draft, Reporting-Endpoints became baseline, and teams can enforce strict policies safely by collecting reports first.
Category
Security & Privacy
19 matching blog articles. Practical security and privacy implementation notes on headers, consent, identity, and protection layers.
Category wiki
Security & Privacy is the broad subject lane for this part of the archive.
Definition
Security and privacy guidance for reducing risk while preserving usability.
What belongs here
Articles land in Security & Privacy when the main subject is hardening, privacy controls, identity safeguards, and risk reduction for modern systems..
How to read it
Treat this category as the broad lane first, then use tags to narrow that subject down to the concrete technologies, platforms, or patterns used inside it.
Common tags in this category
YouTube Video Spotlight: OWASP Top 10:2025 — What Changed and Why It Matters
A practical commentary on the OWASP Foundation's 45-minute Top 10:2025 announcement and what its updated risks mean for web teams.
Infrastructure Secrets Management Without Complexity
A practical, low-drama approach to infrastructure secrets: keep credentials out of Git, use least privilege, rotate deliberately, and introduce Vault when the operational need is real.
Supply Chain Security: Software Bill of Materials in Practice
CISA refreshed the SBOM baseline in July 2026, while the EU Cyber Resilience Act makes machine-readable software inventories a practical roadmap item for teams building or buying digital products.
Vulnerability Management for Small Ops Teams in 2026
The 2026 vulnerability-management reset: NVD now triages CVEs by risk, CISA's KEV list is the priority signal, and small ops teams can patch what matters in days instead of drowning in CVSS scores.
YouTube Video Spotlight: DevSecOps Course for Beginners – API Security
A two-hour freeCodeCamp course on DevSecOps and API security, and why baking security into every stage of delivery matters more than a final security gate for modern engineering teams.
Post-Quantum Cryptography Migration: A Practical Guide
A practical guide to migrating from classical to post-quantum cryptography: NIST-standardized algorithms, hybrid TLS key exchange deployment, OpenSSL/oqs-provider configuration, the White House 2030 deadline, and a phased migration strategy rooted in crypto-agility.
Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Agents — What Teams Need to Know
A confused-deputy vulnerability in Microsoft's Azure DevOps MCP server lets attackers use invisible HTML comments in pull requests to hijack AI coding agents for cross-project data theft. No fix released as of July 22, 2026.
Securing AI Agents Against Prompt Injection — IBM Technology
A production-tested guide to prompt injection defense — covering the IBM Technology video breakdown, why sanitization fails, defense-in-depth strategies, and the checklist every AI agent deployment needs.
Data Governance for AI Workflows in Regulated Industries
A practical data governance framework for AI workflows in regulated industries — covering data classification, retention policies, audit trails, consent management, and vendor risk assessment under GDPR, MiFID II, and the EU AI Act.
Microsoft July 2026 Patch Tuesday: Record 570 Flaws Patched with AI-Powered Discovery
Microsoft July 2026 Patch Tuesday fixes a record 570 security flaws, including 3 zero-days and 59 critical vulnerabilities. AI-powered discovery is the new normal for patch management.
How to Keep Website Forms Clean With Cloudflare Turnstile
Cloudflare Turnstile helps service websites protect forms without forcing visitors through a more annoying CAPTCHA flow.
How to Compare Matomo, Plausible, and PostHog for a Privacy-First Stack
Matomo, Plausible, and PostHog solve different analytics problems, so the right choice depends on reporting depth, privacy, and product tracking needs.
How to Run Security and Accessibility Reviews With OWASP ZAP, WAVE, and SSL Labs
OWASP ZAP, WAVE, and SSL Labs cover different risk layers, and together they give a more realistic review of a website.
Why First-Party Analytics and Consent Belong Together on Small Service Sites
Small service sites usually need fewer tracking layers, not more. A better setup uses first-party measurement, clear notices, and consent only where it is needed.
Make Use of Keepass a Free Open Source Password Manager
KeePass is a free open source password manager, which helps you to manage your passwords in a secure way. You can store all your passwords in one database, which is locked with a master key. So you only have to remember one single master key to unlock the whole database.
4 Ways to Mitigate Pass-the-Cookie Attacks
Pass-the-cookie attacks let attackers reuse stolen session cookies. These four defenses help reduce that risk in cloud and web environments.
Enable MFA Before an Attacker Locks You Out
Enable multi-factor authentication before an attacker does. MFA makes account takeovers harder and recovery far less painful.
What Is SSL and Why Does Your Website Need It?
SSL protects data in transit, enables HTTPS, and helps websites earn browser trust, stronger security, and better search visibility.