Evidence
"Don't trust, verify" — taken to the limit. Everything on this page is generated at build time or read live: no hand-typed numbers, no screenshots. Check every line yourself.
🔐 The why behind each check here — what each header defends, what each layer protects — is explained on Security. See Security →
Latest commit
This site is served from main. The code you are reading matches this commit:
| commit | cb439ed1f8915a0cb7f7b09325f7fb62d515579c |
|---|---|
| message | chore(deps): lock file maintenance (#180) |
| date | 16 Sept 2026, 15:16 |
Security headers
The versioned contract below is what guarantees production actually serves these headers — the same thing checked live by the external scanners linked at the end of this page.
The versioned list of headers production must serve — the Headers workflow fails if any is missing:
| header | requires |
|---|---|
| content-security-policy | default-src 'self'script-srcobject-src 'none'frame-src 'none'worker-src 'none'base-uri 'none'form-action 'none'frame-ancestors 'none'require-trusted-types-for 'script' |
| strict-transport-security | max-age=63072000includeSubDomains |
| x-frame-options | DENY |
| x-content-type-options | nosniff |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | geolocation=()camera=()microphone=() |
| cross-origin-opener-policy | same-origin |
| cross-origin-resource-policy | same-origin |
| cross-origin-embedder-policy | require-corp |
Certificate Transparency watch
Any TLS certificate issued for this domain — including one an attacker managed to obtain after a DNS or registrar takeover — is recorded in public Certificate Transparency logs. The Worker watches those logs and checks every issuance from the last 90 days against the list of expected issuers: a certificate I did not request shows up here before it can be used against me.
The live watch is not wired up yet — the Worker needs to be published on the domain routes. The logic and tests live in dynamic/worker/.
Validity of the certificate in use
⚠️ Expiring soon — confirm the automatic renewal already ran.
No valid certificate for the exact domain and an expected issuer in this window — check the table below.
| Logged | Issuer | Names (CN / SANs) | Status |
|---|
🛰️ 100% public data (CT logs, via crt.sh), cached for 6 h in the Worker. No visitor input — the query is fixed, derived from the domain itself: observability, not a lookup tool.
Workflows
These workflows run on GitHub Actions — most on every push to main, some on a cron (daily/weekly), some only on a release tag. Green = clean build, no known vulnerabilities, and secrets + SAST passing.
The layers that run — each one fails CI if it finds something:
| tool | what it catches |
|---|---|
| Renovate | Keeps dependencies up to date and pins the GitHub Actions by SHA digest (protection against moved tags). Runs on a weekly window. |
| Dependency Review | Blocks PRs that introduce a new dependency with a known vulnerability, scoped to the PR's own diff — the fast gate, complementary to the OSV-Scanner sweep below. |
| OSV-Scanner | Dependencies with known vulnerabilities or flagged as malicious (OSV.dev database + GitHub advisories), read from the lockfile. |
| Gitleaks | Committed secrets — tokens, private keys — across the full PR history. Also as a local hook before every commit. |
| CodeQL | Semantic security analysis (SAST) of the JavaScript/TypeScript — complementary to Semgrep, a different class of patterns. |
| Semgrep | SAST: DOM XSS sinks (innerHTML, document.write) in the client-side scripts and the Lab terminal. |
| zizmor | Audit of the workflows themselves: missing pins, excessive permissions, template injection in run:. |
| Supply chain | Verifies npm registry signatures and generates a CycloneDX SBOM for both lockfiles, as an artifact — weekly. |
| Invariants | Checks /api/health and the Worker's read routes in production; opens an automatic Issue if something breaks — daily. |
| Fuzzing (ClusterFuzzLite) | One harness covers the two Worker functions that parse untrusted network input — sanitizeText()/escapeHtml() (output sanitizers) — weekly. |
| Signed releases | Signs the provenance (Sigstore) of build artefacts and generates an SBOM, on a GitHub Release — only when a v* tag is created. |
Beyond these, the build fails on npm audit high/critical advisories and if the header CSP diverges from the one shipped in each <meta>.
Check for yourself
Don't take my word for it: