https://trufend.com/ 2026-09-20 weekly 1.0 https://trufend.com/product/ 2026-09-20 weekly 0.9 https://trufend.com/guide/ 2026-09-20 monthly 0.9 https://trufend.com/tools/ 2026-09-20 monthly 0.9 https://trufend.com/blog/ 2026-09-17 weekly 0.8 https://trufend.com/blog/api-key-rotation.html 2026-07-15 monthly 0.7 https://trufend.com/blog/images/trufend-api-key-rotation.jpg Rotating API keys on a schedule, not after an incident API key rotation illustration: a weekly calendar with keys cycling through scheduled renewal, automated deployment of a new key, and automatic expiry of the old one, labelled to show rotation as a routine rather than an incident response. https://trufend.com/blog/api-key-scope.html 2026-06-03 monthly 0.7 https://trufend.com/blog/images/trufend-api-key-scope.jpg Scoping service-role and admin API keys API key scope illustration: a narrowly scoped service-role key with limited access to specific resources beside an admin key with full access to every resource, the admin key ringed by a visibly larger blast radius, above an application connected to its database, services and APIs. https://trufend.com/blog/backup-restore-testing.html 2026-06-10 monthly 0.7 https://trufend.com/blog/images/trufend-backup-restore-testing.jpg Backups mean nothing until you restore one Restore testing illustration: data crossing a bridge from backup storage through a restore test that validates and verifies integrity, arriving at a restored and ready application with its data recovered. https://trufend.com/blog/branch-protection.html 2026-07-22 monthly 0.7 https://trufend.com/blog/images/trufend-branch-protection.jpg Branch protection: stopping direct pushes to main Branch protection illustration: feature and bugfix branches climbing to a pull request, through required code review and passing checks, before merging into a protected main branch that refuses direct pushes. https://trufend.com/blog/data-processing-agreements.html 2026-09-09 monthly 0.7 https://trufend.com/blog/images/trufend-data-processing-agreements.jpg Data processing agreements: which ones you need Data processing agreement illustration: a signed DPA bridging a company acting as controller and a vendor acting as processor, listing the clauses it should cover including purpose and scope, types of personal data, security measures, sub-processors, data subject rights, and retention and deletion. https://trufend.com/blog/enforcing-mfa.html 2026-07-01 monthly 0.7 https://trufend.com/blog/images/trufend-enforcing-mfa.jpg Requiring MFA, not just offering it Multi-factor authentication illustration: a sign-in screen above a gate marked secure access only, requiring a second factor by phone approval or security key, labelled to show MFA as mandatory rather than optional. https://trufend.com/blog/exposed-secrets.html 2026-04-15 monthly 0.7 https://trufend.com/blog/images/trufend-exposed-api-keys-public-code-security.jpg Exposed secrets: how API keys end up in public code Exposed secrets illustration: a laptop showing a public code repository with a live API key highlighted on one line of a config file, and a scan panel reporting three secrets found, the API key rated high risk. https://trufend.com/blog/external-security-posture.html 2026-05-13 monthly 0.7 https://trufend.com/blog/images/trufend-external-security-posture-domain-scan.jpg External security posture: what anyone can see from outside your domain External security posture illustration: a browser window showing a company domain, with callouts for DNS records, public subdomains, TLS certificate and protocol versions, exposed assets such as APIs and admin panels, and HTTP security headers. https://trufend.com/blog/free-server-log-analyser.html 2026-09-17 monthly 0.7 https://trufend.com/blog/images/trufend-free-server-log-analyser.jpg A free server log analyser that never uploads your log Free server log analyser: a log window above a mountain range at dawn, showing access log lines with timestamps, 200 and 404 status codes and requested paths beside the user agent strings of Googlebot, Bingbot, AhrefsBot, ClaudeBot, GPTBot, SemrushBot, PerplexityBot and Applebot, with each crawler's route traced across the peaks below and a note that the log is read locally in the browser. https://trufend.com/blog/graceful-degradation.html 2026-06-24 monthly 0.7 https://trufend.com/blog/images/trufend-graceful-degradation.jpg When a dependency goes down, does your app break? Graceful degradation illustration: an application on a mountain peak still online and serving users while one third-party API is marked unavailable and the payments, analytics and email services around it stay healthy, one of them on a fallback route. https://trufend.com/blog/idor-testing.html 2026-05-27 monthly 0.7 https://trufend.com/blog/images/trufend-idor-testing.jpg IDOR: can your customers see each other's data? IDOR illustration: two customer accounts on opposite cliff tops, each holding its own profiles, orders, invoices and support tickets, with a request to another customer's record ID crossing between them and flagged as unauthorised access. https://trufend.com/blog/incident-response-plan-contents.html 2026-08-12 monthly 0.7 https://trufend.com/blog/images/trufend-incident-response-plan-contents.jpg What belongs in a written incident response plan Incident response plan illustration: a path from detection through containment, investigation and recovery, with panels describing the roles involved, the communications required, and the evidence to preserve at each stage. https://trufend.com/blog/not-a-certification.html 2026-04-01 monthly 0.7 https://trufend.com/blog/images/trufend-domain-scan-not-soc-2-certificate.jpg Why we'll never call this a SOC 2 certificate Domain scan versus SOC 2 illustration: a small panel of passing external checks for TLS, certificate validity, open ports and known vulnerabilities, set against a far larger landscape labelled with the internal areas SOC 2 covers, including people and access, processes and policies, data protection, incident response, vendor management and risk governance. https://trufend.com/blog/offboarding-checklist.html 2026-07-08 monthly 0.7 https://trufend.com/blog/images/trufend-offboarding-checklist.jpg The offboarding checklist that actually revokes access Offboarding illustration: a checklist covering revoking access, disabling accounts, removing group membership, transferring ownership and confirming, connected to a departing employee whose access is removed across Google Workspace, Microsoft 365, Slack, GitHub, Salesforce and other applications. https://trufend.com/blog/reading-your-report.html 2026-03-18 monthly 0.7 https://trufend.com/blog/images/trufend-external-security-report-guide.jpg How to read your Trufend report Trufend report illustration: a laptop showing a scan result for a domain with an overall grade, a list of security checks marked pass, issue or warning across TLS, DNS, subdomains, headers and infrastructure, and a readiness checklist of next steps alongside it. https://trufend.com/blog/risk-assessment.html 2026-08-19 monthly 0.7 https://trufend.com/blog/images/trufend-risk-assessment.jpg Documenting a risk assessment in an afternoon Risk assessment illustration: a likelihood and impact matrix beside a list of treatment options covering mitigate, transfer, accept and avoid, with example risks including a data breach, a supplier outage, a service disruption and a regulatory change plotted by their likelihood and impact. https://trufend.com/blog/rto-and-rpo.html 2026-06-17 monthly 0.7 https://trufend.com/blog/images/trufend-rto-and-rpo.jpg RTO and RPO: writing numbers you can actually defend RTO and RPO illustration: a timeline along a mountain ridge from an outage, through the data loss window that the recovery point objective measures, to the restore time that the recovery time objective measures, ending at systems restored. https://trufend.com/blog/secrets-out-of-git.html 2026-07-29 monthly 0.7 https://trufend.com/blog/images/trufend-secrets-out-of-git.jpg Keeping secrets out of your Git repository Secrets in source control illustration: a code editor showing a live API key highlighted in a config file, with pre-commit checks stopping secrets before they reach the repository, secret scanning detecting keys and tokens, and the credentials moving into a secure vault. https://trufend.com/blog/security-headers.html 2026-04-08 monthly 0.7 https://trufend.com/blog/images/trufend-http-security-headers-website-protection.jpg The security headers that actually matter HTTP security headers illustration: layered translucent panels in front of a browser window, each labelled with a header and what it does, covering Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. https://trufend.com/blog/security-training.html 2026-08-26 monthly 0.7 https://trufend.com/blog/images/trufend-security-training.jpg Security training for new hires and contractors Security training illustration: new joiners walking a path marked with the topics onboarding should cover, including phishing awareness, access basics such as accounts and least privilege, device handling, and how to report a problem, beside a welcome checklist. https://trufend.com/blog/spf-dkim-dmarc.html 2026-05-06 monthly 0.7 https://trufend.com/blog/images/trufend-spf-dkim-dmarc-email-authentication.jpg SPF, DKIM and DMARC: stopping people sending email as you SPF, DKIM and DMARC illustration: a legitimate email crossing a bridge through three authentication gates that ask whether the sender is authorised, whether the message was tampered with, and what to do on failure, while a spoofed message fails and is blocked before the recipient inbox. https://trufend.com/blog/subdomain-takeover.html 2026-04-29 monthly 0.7 https://trufend.com/blog/images/trufend-subdomain-takeover-dangling-dns-record.jpg Subdomain takeover: the DNS record that outlived the service Subdomain takeover illustration: a bridge that ends in mid-air at a cliff edge beside a sign reading service gone, labelled with a subdomain whose DNS record still points at a service that no longer exists. https://trufend.com/blog/supabase-row-level-security.html 2026-05-20 monthly 0.7 https://trufend.com/blog/images/trufend-supabase-row-level-security.jpg Row-Level Security: turning it on and checking it Row-Level Security illustration: a database table of orders where some rows are visible and others are locked and greyed out, labelled to show that each user sees only the rows their policy allows and that rows failing the policy stay hidden. https://trufend.com/blog/the-invisible-80.html 2026-03-25 monthly 0.7 https://trufend.com/blog/images/trufend-soc-2-invisible-80-domain-scan.jpg The 80% a domain scan can't see Iceberg illustration: the fifth above the waterline is labelled with what scanners can see, including TLS and certificates, security headers, DNS records, public subdomains and exposed assets, while the far larger mass below is labelled with people and permissions, internal processes, access controls, backups and recovery, incident response and vendor management. https://trufend.com/blog/tls-certificate-checks.html 2026-04-22 monthly 0.7 https://trufend.com/blog/images/trufend-tls-certificate-expiry-configuration-check.jpg Expiring and weak TLS: what breaks, and what to check TLS certificate illustration: a mountain path marked with three waypoints for checking your configuration, disabling old protocols such as SSL and TLS 1.0 and 1.1, and renewing on time, above a panel showing a valid certificate with its issue and expiry dates. https://trufend.com/blog/vendor-inventory.html 2026-09-02 monthly 0.7 https://trufend.com/blog/images/trufend-vendor-inventory.jpg Listing every vendor that touches your data Vendor inventory illustration: a company application at the centre of a map of the external services that touch its data, including infrastructure, source control, collaboration, productivity, CRM, analytics, monitoring, payments and communications, with a count of vendors discovered and data categories. https://trufend.com/blog/vendor-security-review.html 2026-09-16 monthly 0.7 https://trufend.com/blog/images/trufend-vendor-security-review.jpg Reviewing a vendor's security posture without a team Vendor security review illustration: three vendor cards showing what evidence each has provided across TLS, security headers, access controls, a SOC 2 report, subprocessors and vulnerability management, two rated low risk and one still needing review, beside a short review checklist. https://trufend.com/blog/webhook-signature-verification.html 2026-08-05 monthly 0.7 https://trufend.com/blog/images/trufend-webhook-signature-verification.jpg Verifying webhook signatures from Stripe and others Webhook signature illustration: signed events crossing a bridge into an application after their signature is verified, while an event with an invalid signature is rejected and blocked before reaching the app. https://trufend.com/privacy/ 2026-09-20 monthly 0.5 https://trufend.com/terms/ 2026-09-20 monthly 0.5 https://trufend.com/tools/csp-builder.html 2026-09-20 monthly 0.8 https://trufend.com/tools/incident-response-plan.html 2026-09-20 monthly 0.8 https://trufend.com/tools/log-file-analyser.html 2026-09-20 monthly 0.8 https://trufend.com/tools/security-headers-generator.html 2026-09-20 monthly 0.8 https://trufend.com/tools/spf-dmarc-generator.html 2026-09-20 monthly 0.8 https://trufend.com/tools/vendor-dpa-register.html 2026-09-20 monthly 0.8