Cyber preparedness, command-center calm

Learn from real incidents. Defend your own site.

Not how to attack — how to defend, drawn from breaches that actually happened. Practical defense you can act on today, even without a security background.

Browse incidents Start defending

itd@defense:~ — site-health.shLIVE

>.env exposure[ Defended ]
>TLS / cert expiry[ Watch ]
>Dependency CVEs[ Critical ]
>Security headers[ Defended ]
>Secret in repo[ Defended ]

ONLINEThreat feedLIVE 15 Incidents & Vulnerabilities 35 Glossary 32 Security GuidesDEFENSE-ONLY — NO ATTACK STEPS

Featured

Security for the AI era

Capable AI raises the cost of neglect. Lock down the basics now — in priority order.

Read the feature

01 — Sections

Where to start

Pick an entry point by goal. All free, no signup.

Incidents & Vulnerabilities

Capital One, Equifax, Log4Shell, Heartbleed, XZ — public breaches and vulnerabilities broken down into cause, impact, first response, and prevention, for the lessons that still apply.

$ Log4Shell, Heartbleed, Capital One, MOVEit, and more.

History of security

From the 1970s to today — the major incidents, vulnerabilities, malware, and defensive technologies that shaped security, on one timeline. Each entry links to a deeper explainer on this site.

$ Major events and defenses, on one timeline.

Glossary

CVE, CVSS, RCE, SSRF, XSS, SPF/DKIM/DMARC — each term with a one-line answer and a plain explanation.

$ So jargon never trips you up.

Security Guides

Passwords, MFA, devices, public Wi-Fi, servers, dependencies, Git, exposed environments — practical, goal-oriented guides to defenses you can apply today.

$ Practical defense guides, by goal.

Security by Framework

Per-framework security guides — the default dangers, the weaknesses most often exploited, and the hardening steps — for WordPress, Laravel, Next.js, Spring, and more.

$ Defenses specific to your stack.

Free Tools

A free toolset to check dependencies (OSV), CVEs, security headers, CSP, JWT, and SPF/DKIM/DMARC. Diagnostic tools also generate an AI fix prompt. Client-side tools never send your input.

$ Client-side tools never send your input.

02 — Field notes

Notable incidents & vulnerabilities

Capital One, Log4Shell, MOVEit and more — public breaches and vulnerabilities, turned into how you defend.

critical2026-07-18

Tsurugi Handa Hospital ransomware (2021) — an unpatched VPN CVE and the backup trap

The way in, per the expert committee's report, was an internet-facing VPN device left unpatched against a known vulnerability (CVE-2018-13379), reachable with leaked credentials. Short passwords, no account lockout, and users holding admin rights made lateral movement easy. Decisively, the primary system and its backup were on the same network and both were encrypted — a backup that isn't isolated and offline is no backup when it counts. EMR recovery took about two months. Defend by patching internet-facing VPNs fast, revoking leaked/reused credentials, and keeping isolated, offline, 3-2-1 backups.

critical2026-07-18

Osaka General Medical Center ransomware (2022) — a contractor's VPN as the way in, and hospital BCP

The way in was not the hospital itself but a meal-service contractor's remote-maintenance VPN device — unpatched, and reachable using leaked credentials — the investigation committee found. Because the hospital and contractor were constantly connected, and because servers/PCs shared passwords, users held broad admin rights, EMR servers lacked antivirus, and the network wasn't segmented, the encryption spread across the EMR system. Outpatient care, surgery, and emergency intake were restricted; full recovery took over two months. Defend by treating contractor links as your own attack surface: patch internet-facing VPNs, end credential reuse, least privilege, segment, and build a medical BCP (paper fallback, tested restore).

high2026-07-07

7pay Fraud (2019) — How a Payment App With No 2FA Got Taken Over

Account takeovers began the day after launch; ~808 users lost ~¥38.6M. The core failure was authentication design: (1) no two-factor authentication, so login needed only ID + password, and (2) a password reset that could send the new password to an email address other than the registered one — so fragments of personal data were enough to hijack an account. Defend by requiring 2FA on sensitive actions, restricting password reset to registered channels, detecting and locking credential-stuffing, and having auth flows reviewed by a second set of eyes before launch.

03 — Our stance

What this site stands for

A security product has to keep its own house in order.

We don't hold secrets

We never store your real API keys — only metadata. The safest secret is the one we can't leak.

Scan only what you own

Diagnostics run on verified domains only. Internal IPs and metadata endpoints are blocked — SSRF defense is built in.

Minimal blast radius

Isolation so one breach can't cascade. This site itself runs on a dedicated, isolated host.

We test on ourselves

This site watches its own dependencies for CVEs. The incident that started this never gets missed by a human again.