How this site is secured
A site about security should be built the way it recommends. This page describes how this one is put together and protected.
Little to attack
This site is a set of plain pages. It has no database, no accounts or logins, no forms that send anything, and no code running on a server. There is nothing here to sign in to and nothing to submit, which removes most of the ways a website is usually attacked.
Nothing from other companies
Every file a page loads comes from this site: the fonts, the styles, the images, and its scripts. It loads no outside analytics, advertising, embedded media, fonts, or scripts, so no other company's code runs when you visit.
Rules your browser enforces
Every page is sent with instructions that your browser enforces:
- Content Security Policy (Content-Security-Policy, with X-Frame-Options for older browsers). Only this site's own scripts, styles, fonts, and images may load. Pages cannot connect to other services, cannot be placed inside another site's frame, and cannot submit forms.
- HTTPS only (Strict-Transport-Security). Your browser is told to use an encrypted connection for this site for the next year.
- No guessing at file types (X-Content-Type-Options). Files are handled only as the type the site declares.
- No referrer (Referrer-Policy). When you follow a link to another site, that site is not told you came from here.
- Unused device features turned off (Permissions-Policy). Pages cannot ask for your camera, microphone, location, or similar features.
- Isolation from other sites (Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy). Other sites cannot script this site's windows or embed its files.
The tools
Each tool runs entirely in your browser. What you enter stays on your device and is never sent to this site. The privacy page explains this in full.
How changes are made
I built this site with Claude, Anthropic's AI assistant, and I direct the work. I set the requirements, make the design and security decisions, and approve the content before it is published. Claude wrote the code.
Every change is recorded in a version-controlled repository. Each one is then reviewed and tested separately from the build, and I approve it before it is published. The tests cover the browser rules above, keyboard access, and color contrast. The accounts used to host and publish the site are protected with two-factor authentication.
Reporting a problem
If you find a security problem with this site, please write to security@josephloweinfosec.com. The same contact is published at /.well-known/security.txt, the standard location for it.
What this page does not claim
No website is perfectly secure, and this page is not a guarantee. It is an accurate description of how this site is built. If that changes, this page will be updated at the same time.