Trust and security
This site is small on purpose. What it does, and how it is run, is written down here so you can check it rather than take my word for it.
Privacy
Nothing is sent to anyone until you choose. Google Analytics 4 loads only if you accept, in Consent Mode with every kind of storage denied by default and with advertising and profiling features switched off. You can change your mind at any time from the privacy button in the footer.
The site sets no cookies of its own. Your choice (and your language) is kept in your browser, on your device.
Protection in your browser
Every page is served with a strict Content Security Policy. It forbids inline scripts and eval, limits everything to this site (plus Google’s analytics hosts, used only after consent), blocks framing and upgrades insecure requests. HTTPS is enforced for a year (HSTS), the Permissions Policy switches off camera, microphone, location and other sensors, and an opener policy isolates the page from other windows.
You can see all of it in your browser’s developer tools, in the Network tab.
Domain and email
DNSSEC is enabled on the domain. Mail addresses at this domain only receive and forward: SPF and DMARC are set to reject anything sent in the domain’s name that is not authorised.
Security reports go to [email protected]. The machine-readable contact file (RFC 9116) is at /.well-known/security.txt and is renewed with every release.
How a change goes live
Every change runs through an automatic test suite covering accessibility, colour contrast, security headers, page weight and the generated pages, plus a dependency audit that fails on high-severity findings and code scanning for vulnerabilities. A check fails if the published files differ from what the source builds.
A change is first published to a password-protected staging copy. Publishing to production is a separate, manual step that needs a typed confirmation and a reviewer’s approval, and the previous version stays available as a fallback.
Speed is a requirement
A first visit has a budget of 200 KB and 12 requests, enforced by tests: a change that goes over it does not get published. “How this page performed”, in the footer of the home page, shows what your own visit actually cost, measured by your browser.
Monitoring
Every 30 minutes an automatic check confirms that the site answers, that its security headers are present, that the old and www addresses redirect correctly, that the certificate is valid for at least two more weeks, that mail routing is in place and that the security contact file has not expired. A failure sends an alert.
Open source
The whole site, tests and release process included, is public.
Report a problem
Found something wrong? Write to [email protected]. A real person reads it.