Security
This site was designed to expose technical work without adding unnecessary surface area. Here's what's in place, for anyone who wants to check.
Threat model
The architecture — static, no accounts or sessions, with the little that genuinely needs a server (honeypot, password checker) isolated in a separate Worker — is described on This Site. For the threat model, what matters is the consequence: the attack surface stays minimal. What matters is integrity (not serving tampered code) and the privacy of visitors — that is where the layers below focus.
That is the model — what actually tries to get in, live (the honeypot and what Cloudflare stops on the zone), is on the hub, under "This site, in numbers", with detail on Honeypot and Cloudflare.
The security here is one facet of the project that serves this site — the threat model and the architecture decisions behind it are told on the project page.
Headers and why
What is sent on every response, and the reason for it:
| Content-Security-Policy | script-src 'self' and style-src 'self', no 'unsafe-inline': zero inline JavaScript or CSS anywhere on the site, only code from the site's own origin runs. Injected JavaScript does not run. One of the main defences against XSS on this site. |
|---|---|
| Strict-Transport-Security | Forces HTTPS in the browser for 2 years, even if someone tries to downgrade to HTTP. |
| X-Frame-Options: DENY | Stops the site being embedded in another (anti-clickjacking), alongside frame-ancestors in the CSP — for older browsers that do not support the directive. |
| X-Content-Type-Options: nosniff | Stops the browser guessing a file’s type and running it as something it is not. |
| Referrer-Policy | Does not leak this page’s full path to external sites when following a link. |
| Permissions-Policy | Turns off browser APIs the site does not use (camera, microphone, geolocation, payments, USB). |
| Cross-Origin-Opener-Policy | Isolates the browsing context (window/tab) from other origins — stops a window on another site from controlling this one. |
| Cross-Origin-Embedder-Policy | Only loads cross-origin resources that explicitly opt in (CORP/CORS) — part of the cross-origin isolation, alongside COOP. |
| Cross-Origin-Resource-Policy | Stops other sites loading this site’s resources directly — completes the cross-origin trio, the same nine headers required by the contract on Evidence. |
Privacy and data
There are no cookies, no analytics, no third-party scripts. The client-side tools (subnets, hashes, encoder, passwords, email headers, EXIF, CSP analyser, passkey lab) process everything in your browser — no data leaves your machine. The two tools that talk to the Worker (password checker, mirror) say so explicitly and are flagged with a badge on the tools index. Cloudflare, as the infrastructure serving the site, logs standard connection data (IP, User-Agent) for every request by default — that is not something this site adds, but it is not hidden either: the same exposure as any site behind a CDN.
Delivery chain
The code that reaches your browser goes through a chain of checks on every push: dependencies are scanned for known vulnerabilities and for malicious packages, secrets are stopped before they land, client-side scripts go through SAST, and the workflows themselves are audited. The GitHub Actions are pinned by SHA digest and the dependencies kept up to date by Renovate. The detail — which tool catches what — is on the Evidence page.
How to report
Found something? The responsible-disclosure contact policy is published in a machine-readable format:
Verifiable transparency
None of this is meant to be taken on faith — it's meant to be checked. I gathered the proof in one place: the latest commit hash, the header contract (CSP included), and the CI workflows, on push, cron, or tag.