Quiet Failures https://quietfailures.com/quiet-failures/ Security for people who never signed up to do security. A free weekly newsletter: one real, fixable exposure at a company like yours, closed in ten minutes. en-gb The Remote Desktop you opened "just for now" is still open https://quietfailures.com/quiet-failures/exposed-rdp https://quietfailures.com/quiet-failures/exposed-rdp Sat, 15 Aug 2026 00:00:00 GMT A Remote Desktop port forwarded 'just for now' may still expose your Windows PC to the internet, where scanners brute-force it within minutes. How to check yours. Someone else is spending your AI budget on a leaked key https://quietfailures.com/quiet-failures/exposed-llm-api-key https://quietfailures.com/quiet-failures/exposed-llm-api-key Fri, 14 Aug 2026 00:00:00 GMT A leaked OpenAI or cloud API key can quietly run up your bill for years — bots scan for exactly these. How to check your usage and rotate keys in ten minutes. The NAS in the cupboard is answering the whole internet https://quietfailures.com/quiet-failures/exposed-nas-internet https://quietfailures.com/quiet-failures/exposed-nas-internet Thu, 13 Aug 2026 00:00:00 GMT The Synology or QNAP box your team dumps files onto may answer the open internet on its default admin login — exactly what ransomware crews scan for. Check yours. Your second factor is a text message, and that's the weak link now https://quietfailures.com/quiet-failures/sms-mfa-weak https://quietfailures.com/quiet-failures/sms-mfa-weak Wed, 12 Aug 2026 00:00:00 GMT If your two-factor codes arrive by text, a SIM swap or phishing proxy can relay them in real time. Why SMS is now the weak link in MFA, and what to switch to. Your internal mailing list is readable by the whole internet https://quietfailures.com/quiet-failures/google-group-public-visibility https://quietfailures.com/quiet-failures/google-group-public-visibility Mon, 10 Aug 2026 00:00:00 GMT A Google Group set to public years ago still publishes its message archive to anyone who searches. How to check who can view your groups and close them in ten minutes. Your email is signed with a key attackers can forge https://quietfailures.com/quiet-failures/dkim-weak-key https://quietfailures.com/quiet-failures/dkim-weak-key Sun, 09 Aug 2026 00:00:00 GMT That DKIM key you set up years ago is still 1024-bit — below the 2048-bit floor mailbox providers now expect. How to look up your key length and rotate it in ten minutes. Your cloud storage bucket is answering to strangers https://quietfailures.com/quiet-failures/public-cloud-bucket https://quietfailures.com/quiet-failures/public-cloud-bucket Sun, 09 Aug 2026 00:00:00 GMT A storage bucket set to public years ago to unblock a job is still open — and attackers find them through search indexes. How to check your buckets and lock them down. You have six people with the keys to everything https://quietfailures.com/quiet-failures/global-admin-sprawl https://quietfailures.com/quiet-failures/global-admin-sprawl Sat, 08 Aug 2026 00:00:00 GMT Global Administrator got handed out to whoever needed to change one setting. Now several everyday accounts can rewrite your whole Microsoft 365 tenant. How to count them. You deleted the leaked key's repo. The key still works. https://quietfailures.com/quiet-failures/exposed-git-secrets https://quietfailures.com/quiet-failures/exposed-git-secrets Fri, 07 Aug 2026 00:00:00 GMT Deleting a file or repo that held a secret doesn't rotate the credential — and most keys leaked years ago still work. How to find and actually revoke yours in ten minutes. The AI tool a colleague connected months ago just became your breach https://quietfailures.com/quiet-failures/oauth-stale-grant https://quietfailures.com/quiet-failures/oauth-stale-grant Thu, 06 Aug 2026 00:00:00 GMT A third-party AI tool still holds an OAuth token to your mail and files. When its vendor is breached, the attacker logs in as you — no password, no MFA. How to check. The Drive files still shared with clients who left years ago https://quietfailures.com/quiet-failures/external-share-accumulation https://quietfailures.com/quiet-failures/external-share-accumulation Tue, 04 Aug 2026 00:00:00 GMT Tightening your sharing policy only governs new shares. Folders you opened to a former client or a personal Gmail years ago stay open. How to find them in ten minutes. Your password policy still demands a capital, a number and a symbol https://quietfailures.com/quiet-failures/password-complexity-myth https://quietfailures.com/quiet-failures/password-complexity-myth Mon, 03 Aug 2026 00:00:00 GMT The rule forcing an uppercase, a digit and a symbol doesn't make passwords stronger — it just breeds Password1! everywhere. NIST dropped it. What to do instead. The AI tool your team wired up is answering to the whole internet https://quietfailures.com/quiet-failures/exposed-mcp-server https://quietfailures.com/quiet-failures/exposed-mcp-server Sat, 01 Aug 2026 00:00:00 GMT Someone stood up an MCP server so an AI assistant could reach your tools, and it went online with no login. How to check whether your AI endpoint is exposed. The subdomain still pointing at a service you cancelled https://quietfailures.com/quiet-failures/dangling-cname-cancelled-service https://quietfailures.com/quiet-failures/dangling-cname-cancelled-service Fri, 31 Jul 2026 00:00:00 GMT You stopped paying for a cloud service but left the CNAME behind, so a stranger can re-register it and serve their content on your domain. How to find dangling records. Your website is quietly serving its own source code at /.git https://quietfailures.com/quiet-failures/exposed-git-directory https://quietfailures.com/quiet-failures/exposed-git-directory Thu, 30 Jul 2026 00:00:00 GMT A deployed site often ships its hidden .git folder too, letting anyone rebuild your code and lift live credentials. How to check yoursite.com/.git in a minute. MFA passed, and the attacker still walked in through one consent screen https://quietfailures.com/quiet-failures/oauth-consent-phishing https://quietfailures.com/quiet-failures/oauth-consent-phishing Wed, 29 Jul 2026 00:00:00 GMT A phishing kit can pass your user through a real Microsoft login and MFA, then keep a token to their mail and files. How to shut off device-code and app consent. The vulnerability list you'll never reach the bottom of https://quietfailures.com/quiet-failures/vulnerability-management-obsolete https://quietfailures.com/quiet-failures/vulnerability-management-obsolete Sun, 19 Jul 2026 00:00:00 GMT Manually chasing every CVE feels like security, but the backlog only grows and the real exposures hide inside it. How to check whether your process still works. The security headers a library update quietly switched off https://quietfailures.com/quiet-failures/missing-security-headers https://quietfailures.com/quiet-failures/missing-security-headers Sun, 12 Jul 2026 00:00:00 GMT A routine dependency bump can silently stop your site sending its clickjacking and content-type protections. How to check your security headers in one minute. The leaver who can still log in https://quietfailures.com/quiet-failures/stale-offboarded-accounts https://quietfailures.com/quiet-failures/stale-offboarded-accounts Sun, 05 Jul 2026 00:00:00 GMT Offboarding took back the laptop but never disabled the login, so a former colleague's account is still live. How to find dormant accounts in ten minutes. The 'npm install' that ran a stranger's code on your machine https://quietfailures.com/quiet-failures/npm-install-scripts https://quietfailures.com/quiet-failures/npm-install-scripts Sun, 28 Jun 2026 00:00:00 GMT A single npm install can run someone else's script the moment you type it — no import, no run. How to turn off install scripts and check you're covered. The certificate nobody's job it is to renew https://quietfailures.com/quiet-failures/cert-expiry-automation https://quietfailures.com/quiet-failures/cert-expiry-automation Sun, 21 Jun 2026 00:00:00 GMT Your TLS certificate renews because someone remembers to do it — and lifetimes are shrinking fast. How to find your expiry date and automate renewal in ten minutes. MFA is on, but the old protocols that ignore it never got turned off https://quietfailures.com/quiet-failures/legacy-auth-enabled https://quietfailures.com/quiet-failures/legacy-auth-enabled Sun, 14 Jun 2026 00:00:00 GMT You require MFA — but legacy sign-in protocols can't enforce it, so a password-spray walks straight past. How to find and block legacy authentication. Your AI assistant can read every file your permissions forgot about https://quietfailures.com/quiet-failures/ai-copilot-oversharing https://quietfailures.com/quiet-failures/ai-copilot-oversharing Sun, 07 Jun 2026 00:00:00 GMT Copilot and Gemini don't leak new data — they surface years of stale 'anyone' links and over-broad access to whoever asks. How to find oversharing. The package your AI assistant invented, and someone registered https://quietfailures.com/quiet-failures/slopsquatting-ghost-package https://quietfailures.com/quiet-failures/slopsquatting-ghost-package Sun, 31 May 2026 00:00:00 GMT AI coding tools confidently suggest install commands for packages that don't exist — and attackers register those names. How to check a dependency is real before you install. Your backup works. Your restore is the part you never tested. https://quietfailures.com/quiet-failures/untested-restore https://quietfailures.com/quiet-failures/untested-restore Sun, 24 May 2026 00:00:00 GMT Having backups isn't the same as being able to restore. If they share your login and network, ransomware takes them too. How to test a real restore in ten minutes. The share link set to 'anyone with the link' https://quietfailures.com/quiet-failures/public-share-exposure https://quietfailures.com/quiet-failures/public-share-exposure Sun, 17 May 2026 00:00:00 GMT A folder shared as 'anyone with the link' to unblock a client can stay public and indexable for years. How to audit your Drive, Dropbox and buckets in ten minutes. The AI browser add-on that can read your inbox https://quietfailures.com/quiet-failures/ai-agent-inbox-access https://quietfailures.com/quiet-failures/ai-agent-inbox-access Sun, 10 May 2026 00:00:00 GMT A team member gave an AI browser assistant access to mail and docs — and a hidden instruction on a web page can redirect it. How to audit extension access in ten minutes. Your internal dashboard is on the public internet https://quietfailures.com/quiet-failures/exposed-admin-panel https://quietfailures.com/quiet-failures/exposed-admin-panel Sun, 03 May 2026 00:00:00 GMT The Grafana or Jenkins box you stood up for the team may be reachable from the open internet on admin/admin. How to check your own exposure in ten minutes. Your info@ mailbox is a login nobody protected https://quietfailures.com/quiet-failures/shared-mailbox-login https://quietfailures.com/quiet-failures/shared-mailbox-login Sun, 26 Apr 2026 00:00:00 GMT Shared mailboxes like info@ and sales@ often keep an enabled account with a password and no MFA — a side door into your tenant. How to close it in ten minutes. The .env file that quietly rode into a public repo https://quietfailures.com/quiet-failures/env-file-in-public-repo https://quietfailures.com/quiet-failures/env-file-in-public-repo Sun, 19 Apr 2026 00:00:00 GMT One 'git add .' can commit your .env with live API keys, and bots harvest them within minutes. How to check your repos and rotate what leaked in ten minutes. You're still forcing password changes every 90 days https://quietfailures.com/quiet-failures/password-rotation-myth https://quietfailures.com/quiet-failures/password-rotation-myth Sun, 12 Apr 2026 00:00:00 GMT Forcing a password change every 90 days trains people into weaker passwords, not stronger ones — and NIST retired the advice. What to do instead, and how to switch it off. The inbox rule an attacker left behind https://quietfailures.com/quiet-failures/malicious-inbox-rules https://quietfailures.com/quiet-failures/malicious-inbox-rules Sun, 05 Apr 2026 00:00:00 GMT After a phishing compromise, a hidden mail rule can keep deleting or forwarding your mail — and a password reset never touches it. How to find and clear it in ten minutes. Your DMARC record is set — and doing nothing https://quietfailures.com/quiet-failures/dmarc-record-doing-nothing https://quietfailures.com/quiet-failures/dmarc-record-doing-nothing Sun, 29 Mar 2026 00:00:00 GMT A p=none DMARC record enforces nothing — spoofed mail sails through and failing mail still lands. How to read your policy and turn it on in ten minutes. The subdomain you forgot points at a service anyone can claim https://quietfailures.com/quiet-failures/dangling-subdomain-takeover https://quietfailures.com/quiet-failures/dangling-subdomain-takeover Sun, 22 Mar 2026 00:00:00 GMT An old CNAME pointing at a cloud service you stopped paying for lets a stranger serve their content on your domain. How to find dangling DNS records in ten minutes. Your SPF record is silently failing https://quietfailures.com/quiet-failures/spf-record-silently-failing https://quietfailures.com/quiet-failures/spf-record-silently-failing Sun, 15 Mar 2026 00:00:00 GMT SPF is allowed only ten DNS lookups before it quietly breaks — and a growing company crosses that line with no error message. How to check yours in ten minutes and fix it. The OAuth grant nobody revoked https://quietfailures.com/quiet-failures/oauth-grant-nobody-revoked https://quietfailures.com/quiet-failures/oauth-grant-nobody-revoked Sun, 08 Mar 2026 00:00:00 GMT The third-party apps your team connected years ago still have live access to your email and files — and it bypasses MFA. How to find and revoke OAuth grants.