# Security field guides — geearr

- [How to get DMARC to p=reject without breaking email](https://geearr.com/guides/dmarc-p-reject-rollout) — A step-by-step DMARC enforcement rollout: inventory senders, fix SPF’s 10-lookup limit, align DKIM, move from p=none to quarantine to reject, and lock down parked domains.
- [Penetration test vs. vulnerability scan: what’s the difference?](https://geearr.com/guides/pentest-vs-vulnerability-scan) — How penetration tests and vulnerability scans differ, what scanners cannot find, which one PCI DSS 4.0, SOC 2 and HIPAA expect, and what a good pen test report contains.
- [Security checklist for AI-built (vibe-coded) apps](https://geearr.com/guides/ai-built-app-security-checklist) — A practical pre-launch security checklist for apps built with Cursor, Claude, Lovable, Bolt or v0: secrets in bundles, Supabase RLS, server-side authorization, environments, backups and LLM agent risks.
- [OAuth 2.0 & OpenID Connect security review checklist](https://geearr.com/guides/oauth-oidc-security-review) — An OAuth 2.0 / OIDC security checklist based on RFC 9700: PKCE everywhere, exact redirect URI matching, strict JWT validation, token storage, refresh token rotation and sender-constrained tokens.

---
Canonical: https://geearr.com/guides · Updated: 2026-10-12 · Site index for LLMs: https://geearr.com/llms.txt