Colophon

How this site is built, and what it does and does not do.

Built

A Node script turns plain files into static HTML. There is no framework and no runtime dependency. Anyone can read the whole build in an afternoon.

Private by default

The site sets no cookies and runs no analytics. It makes no third-party requests, and the fonts are self-hosted. Your browser stores one thing: the theme you pick.

Locked down

A strict content security policy lets pages load scripts, styles and fonts from this origin only. The site also sets HSTS, blocks framing and turns off content sniffing. Run curl -I to check.

Documents

Every PDF passes a check before it ships. The check refuses embedded scripts, attachments, forms and author metadata.

Reporting a problem

Message me on LinkedIn or GitHub. The links are on the home page and in security.txt. Real reports get a reply.