Notes on building and breaking the web.

Field notes from a fullstack developer moving into security: hardening the sites I build, and what I learn testing them.

Oct 7, 2026Security · Web

Security headers for a static site: the short list

A static site has no server code to exploit, but its HTTP headers still decide how a browser treats it. The six I set on every deploy, what each one stops, and how to check them.

Let's build software that holds up.

Get in touch