Secured.

The site is static HTML, CSS and a little JavaScript. There's no server code, no database, no login and no form, so there's nothing to inject into and nothing to log in to. Contact is a plain email link.

Scripts and styles load only from this domain. The one inline script applies your saved theme and palette before the page paints (and decides whether the startup screen plays), and it's allowed by its SHA-256 hash, not by a blanket exception. There are no inline styles, no eval and no third-party code.

Trusted Types are enforced too: the site's scripts never turn strings into HTML, and the browser blocks any code that tries.

default-src 'none';
script-src 'self' 'sha256-ReLEU7l46Kqa/JPeLw7yFyd0rYU47SrNE+FLXvtYCxk=';
style-src 'self';
img-src 'self';
font-src 'self';
connect-src 'none';
base-uri 'none';
form-action 'none';
frame-ancestors 'none';
object-src 'none';
upgrade-insecure-requests;
require-trusted-types-for 'script';
trusted-types 'none'

Strict-Transport-Security

max-age=31536000; includeSubDomainsBrowsers only ever talk to this site over HTTPS.

X-Content-Type-Options

nosniffFiles are used only as the type they're served as.

X-Frame-Options

DENYNo other site can frame this one (clickjacking). The CSP says the same with frame-ancestors.

Referrer-Policy

strict-origin-when-cross-originOther sites see only the domain you came from, never the full URL.

Permissions-Policy

accelerometer=(), browsing-topics=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), usb=()Camera, microphone, location, payments, USB and the rest are off. This site has no use for them.

Cross-Origin-Opener-Policy

same-originPages opened from here can't reach back into this window.

Cross-Origin-Resource-Policy

same-originOther sites can't embed this site's files.

Cross-Origin-Embedder-Policy

require-corpThe page only loads resources that opt in, which keeps it cross-origin isolated.

Content-Security-Policy

Only this domain can supply scripts, styles, fonts and images. Framing, plugins, form posts and base-URL tricks are switched off.

The fonts are self-hosted. There are no analytics, no trackers, no cookies and no scripts from a CDN. Your browser talks to this domain and nothing else.

The site remembers two things in your browser's local storage: light or dark, and which colour palette you picked. None of it ever leaves your device.

Every build runs a check over the finished pages. It fails if anything needs more than the policy allows: an inline script without a pinned hash, an inline style or event handler, or a file from another origin. The host's header config is generated from the same source as the policy shown here.

The repos featured here are private, so there are no repo links, and every case study uses a mock-up with demo data instead of screenshots. The freelance client isn't named. Audit findings are only described after they were fixed. My phone number isn't on the site or on the web version of my resume.

Please tell me: Jimenezaerroljj@gmail.com. The details are also in security.txt. You can check the headers yourself on securityheaders.com.