Colophon

How this site is built, and what it cannot do.

A security engineer's site should be able to show its work. This page follows the code; if the two disagree, the code wins and this page has a bug.

Stack

Plain files on a Worker

Hand-written HTML and CSS, one small JavaScript file, no framework and no build step.
Served by a Cloudflare Worker with static assets. A D1 (SQLite) database holds only the owner's sign-in data and an audit log.
Type: Newsreader for headings and reading text, Public Sans for the interface, IBM Plex Mono for data, from Google Fonts.

Security

Every response carries a Content-Security-Policy with no inline scripts and no inline styles, plus HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
security.txt and a security policy say where to report problems.
The owner's admin sits behind a password, a Turnstile check and a lockout; every attempt is logged.

Tests and pipeline

Nothing reaches the live site without a merged pull request. Local hooks refuse commits to main, force pushes, secrets and large files.
Every change runs type checks, lint, unit and property-based tests (fast-check), and mutation testing on the Worker's security helpers: Stryker breaks the code in a few hundred ways, and the tests must notice at least 80% of them. Current score: 89%.
Then: secret scanning over the whole git history (gitleaks), a dependency audit, static analysis (Semgrep), a workflow audit (zizmor), deploy, and a smoke test against the live site.

Limits

Hide your visit from Cloudflare, which serves it, or from Google, which serves the fonts.
Make the text true. A strict CSP limits what a compromised script could do; it says nothing about the words.
Show you the source yet. The repository is private for now.

Privacy

No cookies for visitors. The only two belong to the owner: the admin session, and a marker that shows the owner's footer links.
Visits are counted by Cloudflare Web Analytics, which sets no cookies. [at launch]
The job-age demo runs in your browser and talks to the employer's hiring system directly; nothing goes through this site.

Design language

Highlight: A fact from the employer, or from a proof.
Clay: What a job board claims. Brass is what the employer says.
∎: Proved, or the end of a piece: the end-of-proof mark.
Night plates: The first screen, the one block per page that matters most, code, and the footer. Everything you read sits on parchment.