How this site is secured

A security leader's own site should hold up to the same questions I would ask of yours. Here is the threat model, the control, and where to check it.

ThreatControlHow it is metCheck it yourself
Someone injects a script into the pageSC-18Mobile CodeA strict Content Security Policy. Every script and style is hashed at build time, so the browser refuses anything else.View the page source and look for the content-security-policy meta tag.
Traffic is read or altered in transitSC-8Transmission Confidentiality and IntegrityHTTPS only, HTTP Strict Transport Security with preload, and insecure requests upgraded automatically.Response headers on any page.
A server or database is compromisedCM-7Least FunctionalityThere is no server code, no database, no login, and no forms. The site is static files.The project builds to plain HTML, CSS, and a few small scripts.
A dependency is tampered withSR-3Supply Chain Controls and ProcessesA small dependency set pinned by a lockfile, built ahead of time. Fonts and media are self-hosted, and nothing loads from another domain.The network panel shows every request going to this site only.
Visitors are tracked or profiledSA-9External System ServicesNo analytics, no cookies, no third-party embeds. A remembered lens choice stays in your own browser.No cookies are set. Check your browser storage.
The page is framed to trick clicksSC-7Boundary Protectionframe-ancestors 'none' and X-Frame-Options DENY stop other sites from embedding this one.Response headers on any page.
A researcher finds a flaw and has nowhere to report itRA-5(11)Public Disclosure ProgramA security.txt file under RFC 9116 with a contact and an expiry date that refreshes on every build./.well-known/security.txt

Control IDs are NIST SP 800-53 Rev. 5. The header-based controls apply when the site is served with the included headers file.

Found something? Message me on LinkedIn. I read every report.

When to call me

  1. Build your compliance program from scratch.

    Customers or regulators require a framework, and there is no program behind it yet.

    Done before: 90+ authorizations carried to a decision, with controls built once and inherited across 75+ systems.

  2. Build your security program from zero.

    You are hiring your first security leader and need policy, testing, and a team stood up in the right order.

    Done before: Led 19 staff on a $45M program and took a 10-person team through 15 authorization packages.

  3. Turn security risk into board decisions.

    Your board hears about security in jargon, or not at all, and cannot tell what to fund.

    Done before: Findings briefed to client leadership, CISOs and directors included, in risk terms they acted on.

  4. Stand up an offensive testing program.

    You want to know what an attacker would find before a customer or an auditor does.

    Done before: 100+ penetration tests, and a testing program for 10,000+ devices in 8 countries.

  1. Stand up an offensive testing program.

    You want to know what an attacker would find before a customer or an auditor does.

    Done before: 100+ penetration tests, and a testing program for 10,000+ devices in 8 countries.

  2. Build your security program from zero.

    You are hiring your first security leader and need policy, testing, and a team stood up in the right order.

    Done before: Led 19 staff on a $45M program and took a 10-person team through 15 authorization packages.

  3. Build your compliance program from scratch.

    Customers or regulators require a framework, and there is no program behind it yet.

    Done before: 90+ authorizations carried to a decision, with controls built once and inherited across 75+ systems.

  4. Turn security risk into board decisions.

    Your board hears about security in jargon, or not at all, and cannot tell what to fund.

    Done before: Findings briefed to client leadership, CISOs and directors included, in risk terms they acted on.

Open to full-time security leadership roles, and happy to have an advisory conversation.

Message me on LinkedIn