Security
Site security
Hardening applied to this static Astro site. Report issues tohello@villymane.com.
Controls in place
- HTTPS with HSTS (preload-ready)
- Content Security Policy (CSP)
- Clickjacking protection (`X-Frame-Options`, `frame-ancestors`)
- MIME sniffing blocked (`X-Content-Type-Options`)
- Referrer and Permissions Policy restrictions
- Cross-Origin Opener / Resource Policy
- Self-hosted fonts (no Google Fonts third-party requests)
- Optional analytics only after cookie consent
- Contact via mailto (no inbound form API surface)
- Security contact file at `/.well-known/security.txt`
Report a vulnerability
Email hello@villymane.com with steps to reproduce. Please avoid public disclosure until I can respond.