Contact

Security

Hardening, testing and the security side of shipping web products. Notes from a fullstack developer moving into security, written as I go.

Security · Web

Security headers for a static site: the short list

A static site has no server code to exploit, but its HTTP headers still decide how a browser treats it. The six I set on every deploy, what each one stops, and how to check them.

Let's build software that holds up.

Get in touch