Security

Security and Data Protection

Documents the static site's responsibility boundaries, applied controls, and platform limitations.

Applied architecture

Static HTML and CSS generated by Jekyll 4 with minimal first-party JavaScript
No server database, authentication, payment, upload, comments, or contact backend
jekyll-theme-simplex 0.9.8.15 and build dependencies locked by Gemfile.lock
GitHub-maintained Actions pinned to full commit SHAs
Source and build scans for credentials, licenses, personal data, and source maps

Residual limits

GitHub Pages cannot define arbitrary X-Frame-Options or CSP frame-ancestors response headers, so the clickjacking header control is a PLATFORM LIMITATION.
The site build cannot verify GitHub-account 2FA/passkeys or local-device encryption and auto-lock. The account owner and device administrator must check them separately.
DDoS edge mitigation belongs to GitHub’s platform responsibility and complete blocking is not guaranteed.

Detailed records are available in the repository security directory.