25 security base rates · 82 countries & regions an original dataset, measured weekly by us · free to cite (CC BY 4.0) · explore →
Quiet Failures · a free weekly newsletter

Security for people who never signed up
to do security.

Every week, one real, fixable thing quietly broken or exposed at a company like yours — found, explained, and closed in about ten minutes. Enterprise-grade security, sized for a team that hasn't got one.

Check your inbox — confirm and you're in. Latest issue: Your vibe-coded app is shipping its API keys to the browser.

Free · one issue a week · no pitch · unsubscribe anytime

posture · acme-co.example watching
spf & deliverability
PASS
Passing — for now. Sitting one DNS lookup under the limit that breaks it.
dns & nameservers
CLEAN
No dangling records. Nothing pointing at infrastructure you no longer own.
tls certificate
9 DAYS
Renews in 9 days. The reminder goes to an inbox belonging to someone who left.
backups
NIGHTLY
Running every night. Verified by a test restore — not just assumed.
oauth grants
EXPOSED
A marketing app from 2023 can still read every inbox. It never meets your MFA.
admin accounts
OWNED
No orphaned or service accounts. Every leaver fully offboarded.
Two amber. Nothing on fire — which is exactly why no one looks. That's the gap we cover.
What lands in your inbox

One quiet failure, taken apart the same way every time.

No news roundup, no vendor noise. Each issue does three things — and the middle one is the point: you can check it yourself, today, whether or not you ever buy anything.

01 / THE FAILURE

What's quietly broken

One specific exposure, and why it stays invisible until the day it doesn't.

02 / FIND IT YOURSELF

The ten-minute check

The exact steps to see whether you've got it — real commands, real menus, no tooling required.

03 / THE FIX

What good looks like

How to close it for good, and how to stop it quietly coming back.

ISSUE 37 quiet-failures · sample
WEEKLY · 6 MIN READ

Your vibe-coded app is shipping its API keys to the browser

An AI-assisted app can bake your OpenAI or cloud key straight into the frontend, where anyone can read it. How to check your own site in ten minutes.

Read the issue →
Don't wait for the issue

Scan your own quiet failures, free.

Each tool runs a real check and shows you exactly what it found. No account needed to look.

Quiet Failures

Find the risk before it finds you.

Join the people running their own posture checks every week — with no security team and ten spare minutes.

Check your inbox — confirm and you're in. Latest issue: Your vibe-coded app is shipping its API keys to the browser.

Free · one issue a week · no pitch · unsubscribe anytime