METHSEC

2026-10-14

How this site is built and locked down

This site is a handful of static files served by Cloudflare Workers static assets. There is no framework, no build server and no database, which keeps the attack surface small.

Stack

  • Plain HTML, CSS and JavaScript, served as-is.
  • Fonts (Rajdhani and JetBrains Mono) are self-hosted, so a visit makes no requests to Google.
  • Writeups are Markdown files turned into HTML by a small script before commit. Nothing is rendered at request time.

Response headers

Every response carries a restrictive set of headers from a _headers file:

  • Content-Security-Policy with default-src 'none' and only 'self' allowed for scripts, styles, images and connections. There is no unsafe-inline.
  • Strict-Transport-Security, X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer and a Permissions-Policy that turns off device APIs the site never uses.
  • Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy set to same-origin.

Getting a strict CSP meant moving every inline script and style into separate files, which is also why the page source stays readable.

Things worth checking on your own site

curl -sI https://methsec.com | grep -iE 'content-security|strict-transport|x-content-type'
curl -s -o /dev/null -w "%{http_code}\n" https://methsec.com/.git/config

The second command matters more than it looks. While setting this site up, a first deploy briefly exposed the repository's .git directory as a static asset. An ignore file now keeps it out, and the check above is how I verified the fix on the live site.

Disclosure

If you find something on this site, contact details are in security.txt.

← All writeups