Security posture
How this site defends itself.
The portfolio requires no visitor account, and sets no cookies, trackers or third-party scripts for visitors.
Threat model (abridged)
- COOKIES
- 0
- DB_QUERIES
- 0
- TRACKING_PIXELS
- 0
- THIRD_PARTY_SCRIPTS
- 0
- USER_ACCOUNTS
- 0
- HEADERS_SERVED
- 22
The application keeps no visitor records. Hosting access-log retention depends on operational configuration.
Defense in depth (cross-section)
- L1EDGE (VERCEL OR CADDY)requests are first judged here
- L2HTTP HEADERS22 declared, applied per route
- L3CSProute-specific policies
- L4METHOD FILTER405 for verbs this site never implements
- L5STATIC + NODEportfolio pages + server-rendered 404
- L6DATAno accounts, no database, no visitor records
Most pages are static, but the 404 route and the middleware execute server-side code and need security review too.
HTTP defense headers (verbatim)
Every header below is defined in vercel.json and served on real responses. The same manifest is re-applied by Caddy and the in-app middleware when self-hosted.
/(.*)
- Strict-Transport-Security
- max-age=63072000; includeSubDomains; preload
- X-Content-Type-Options
- nosniff
- X-Frame-Options
- DENY
- Referrer-Policy
- no-referrer
- Cross-Origin-Opener-Policy
- same-origin
- Cross-Origin-Resource-Policy
- same-origin
- Cross-Origin-Embedder-Policy
- credentialless
- Origin-Agent-Cluster
- ?1
- X-Permitted-Cross-Domain-Policies
- none
- X-XSS-Protection
- 0
- X-DNS-Prefetch-Control
- off
- Permissions-Policy
- accelerometer=(), ambient-light-sensor=(), aria-notify=(), autoplay=(), battery=(), bluetooth=(), browsing-topics=(), camera=(), captured-surface-control=(), compute-pressure=(), cross-origin-isolated=(), deferred-fetch=(), deferred-fetch-minimal=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), identity-credentials-get=(), idle-detection=(), interest-cohort=(), join-ad-interest-group=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-create=(), publickey-credentials-get=(), run-ad-auction=(), screen-wake-lock=(), serial=(), shared-storage=(), speaker-selection=(), storage-access=(), synced-reading=(), usb=(), unload=(), web-share=(), window-management=(), xr-spatial-tracking=()
- X-Security-Contact
- https://harukakaya.dev/.well-known/security.txt
/((?!(?:keystatic|api/keystatic)(?:/|$)).*)
- Content-Security-Policy
- default-src 'self'; script-src 'self'; style-src 'self' https://fonts.googleapis.com; style-src-attr 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; media-src 'self'; worker-src 'self'; manifest-src 'self'; frame-src 'none'; child-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'; block-all-mixed-content; upgrade-insecure-requests
/keystatic/:path*
- X-Robots-Tag
- noindex, nofollow
- Cache-Control
- no-store
- Content-Security-Policy
- default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://avatars.githubusercontent.com https://raw.githubusercontent.com; font-src 'self' data:; connect-src 'self' https://api.github.com https://raw.githubusercontent.com; worker-src 'self' blob:; frame-ancestors 'none'; base-uri 'self'; form-action 'self' https://github.com; object-src 'none'; upgrade-insecure-requests
/api/keystatic/:path*
- X-Robots-Tag
- noindex, nofollow
- Cache-Control
- no-store
- Content-Security-Policy
- default-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'self' https://github.com
/.well-known/security.txt
- Content-Type
- text/plain; charset=utf-8
- Cache-Control
- public, max-age=86400
Found a vulnerability?
Send reproduction steps and impact through the contacts in security.txt.
Hall of fame
Researchers who found a vulnerability here and earned a place on this list:
(this space intentionally left blank)