Site posture
This site practises what it preaches.
A security architect's own website should pass the checks he would run on a client's. These are the controls it runs with. Don't take my word for it: each has a link to an independent check.
| Control | Setting | Status | Verify |
|---|---|---|---|
| Content-Security-Policy | Scripts, styles and fonts only from this site; no inline scripts; framing blocked | On | securityheaders.com |
| HSTS | HTTPS only for 1 year, including subdomains, preload-ready | On | securityheaders.com |
| Third-party scripts | None, apart from cookie-free Cloudflare Web Analytics | On | MDN HTTP Observatory |
| Cookies and tracking | No cookies, no trackers, no session recording | On | MDN HTTP Observatory |
| Fonts | Self-hosted IBM Plex, no font CDN | On | MDN HTTP Observatory |
| Email domain | SPF, DKIM and DMARC published for ashwinyadav.com | On | internet.nl mail test |
| security.txt | Vulnerability contact published at /.well-known/security.txt | On | View the file |
| Data collected | No forms and no personal data stored | On | — |
The site is served over HTTPS through Cloudflare. Pages are rendered on the server with no database, so there is nothing to inject into and no visitor data to leak.