Security of this site

A portfolio has nothing to hide, but it should still protect its visitors. Here is, in plain language, what this site does.

No trackers, no cookies

No Google Analytics, no advertising pixel, no cookies. The site loads no script from any other company. Only your light or dark theme choice may be remembered in your browser, and it never leaves it.

Content-Security-Policy (CSP)

A strict list of what the browser is allowed to load: only files from this site. If someone tried to inject a malicious script, the browser would refuse to run it.

Strict-Transport-Security (HSTS)

Forces the browser to always use an encrypted connection (HTTPS) with this site, even if you type the address without “https”.

X-Content-Type-Options

Stops the browser from “guessing” a file’s type, a trick sometimes used to pass off a booby-trapped file as an image.

Referrer-Policy

Limits what other sites learn when you click an outbound link: they see the site name, not the exact page.

Permissions-Policy

Blocks access to the camera, microphone, geolocation and payments. This site does not need them, so no one can use them through it.

Framing protection (frame-ancestors)

The site cannot be displayed inside another site, which blocks fake-click attempts (“clickjacking”).

Contact form

Messages are received by Netlify, the site’s host, and are only used to reach me. An invisible field traps spam bots. The email address does not appear in plain text in the site’s pages, to avoid address-harvesting bots.

Reporting an issue

The /.well-known/security.txt file explains how to report a security issue to me.