Security
Security is the product, not a footnote.
This is a security professional's site, so it holds itself to the standard it recommends. Here's how it's built — and how to report an issue.
Defense in depth
Security isn't one control — it's layers. This site is built so that no single failure exposes anything, and every layer assumes the one before it could be bypassed.
Least privilege by default
Access is closed unless it needs to be open. The admin surface is locked down to a single strong identity, and nothing sensitive is ever exposed to the browser.
Trust nothing from the outside
Every request that crosses a boundary is treated as hostile until proven otherwise — validated, constrained, and rate-limited before it can touch anything that matters.
Responsible disclosure
Found something? Tell me.
If you believe you’ve found a security vulnerability in this site, please report it privately before disclosing it publicly. I’ll acknowledge your report, investigate, and keep you updated on the fix.
- Email a clear description with steps to reproduce.
- Give me reasonable time to remediate before any public disclosure.
- Don't access or modify data that isn't yours, and avoid privacy violations or service disruption.