Blog
Is post-quantum key exchange still on after your last CDN change?
A CDN change can turn off post-quantum key exchange while your pages keep loading without a warning. Browsers fall back to classical key exchange when the new setup doesn't offer hybrid groups.
A new script source lets another domain run code on your pages
Your Content Security Policy (CSP) names the hosts allowed to run JavaScript on your pages. A deploy can add a host to that list, and nothing on the page looks different.
One DNS record can let a CA keep issuing for your domain
Someone who gets into your DNS briefly can leave a record that lets them keep getting certificates for your domain after you lock them out. The record can stay valid until someone removes it or it expires.
Any certificate renewal can change your issuer
Your site can serve a certificate from a different issuer after a renewal, with nobody on your team involved. The change may come from your provider's choice of certificate authority (CA), or from your name pointing at a different provider. Only you can tell which.
Can a client sign in to your MCP server on its own?
When someone adds your Model Context Protocol (MCP) server to an AI client, the client has to find your sign-in by itself. If one step is missing, the user sees an error, and you don't.
MCP tools can change after you approve them
A model decides what to do from a Model Context Protocol (MCP) server's tool descriptions. The server can change them after you connect it, and nothing tells you.
Your x402 quote decides where the money goes
With x402, an agent pays for a web request on its own: it reads the quote your server sends back and pays it. Change one field in that quote, and the money goes somewhere else with nobody watching.