Revoke third-party account access without assuming it deletes their data
Review Google account connections, distinguish sign-in from data permissions and remove access you no longer intend to grant.
Google — Manage third-party connections
Find a guide for the task at hand 10
Search for a problem or tool, or browse guides and comparisons by section.
274 topics in Arabic and English
A frontend environment variable is not a secret API key
Check the browser bundle and network requests, move privileged calls to a server and rotate a key if it has already shipped.
docs.github.com
Handle a GitHub secret-scanning alert as a credential incident
Confirm the detected credential, revoke it at its issuer and review use before closing the repository alert.
docs.github.com
Review a dependency security update instead of clicking merge blindly
Trace a vulnerable package through the lockfile, understand the advisory and test the affected behaviour before deployment.
docs.github.com
Protect npm publishing with account 2FA and a scoped release path
Secure the maintainer account, review package publishing access and use supported trusted publishing where appropriate.
npm — Configure two-factor authentication
Check a package name before an install executes its code
Compare the exact registry name with the project’s official instructions, then inspect metadata and lifecycle scripts before installing.
owasp.org
Review a software dependency’s supply chain before trusting it
Check origin, build and distribution, update policy and the permissions a dependency gains in your environment.
OWASP — Software Component Verification Standard
Protect CI/CD credentials from the code your pipeline builds
Separate untrusted checks from privileged releases, scope workflow permissions and review third-party actions as executable dependencies.
docs.github.com
Apply least privilege without blocking legitimate work
Separate everyday access from administration, grant permissions for a defined task and review access when the task ends.
nist.gov
Cloud IAM: separate the owner, human users and application roles
Protect the recovery owner, use roles for day-to-day access and give workloads their own limited credentials.
AWS — IAM security best practices
Keep security logs that answer a question without collecting secrets
Record sign-ins, permission changes and privileged actions, protect the logs and make sure a harmless test event appears.
nist.gov
A small website may be compromised: contain access before restoring files
Preserve evidence, protect the hosting and domain accounts and recover from a verified clean version without overwriting the investigation.
NIST — Incident response recommendations
Laptop encryption protects a lost drive, not an unlocked session
Check device encryption, preserve its recovery key and distinguish powered-off data protection from account and malware security.
support.apple.com
Review Android app permissions by what each app needs to do
Inspect camera, microphone, location and contacts access, use narrower options where available and test the affected feature.
Google — Android app permissions
Prepare your phone for loss, updates and account recovery
Check the screen lock, device locator, backup and recovery methods while the phone is still in your hands.
safety.google
A GitHub Action tag can move: review the executable revision
Understand tags versus immutable commit references, verify the resolved action and keep pinned dependencies maintainable.
Google — CI/CD hardening
Build an update inventory for the devices you usually forget
Track browsers, operating systems, routers and other connected devices, with owners and support status instead of relying on one notification.
CISA — Secure Our World
Review the dependency an AI coding assistant just added
Inspect the exact new package and lockfile resolution before installation or deployment, rather than trusting a plausible generated import.
Google — CI/CD hardening