A deliberately small attack surface.

GitHub Pages serves static files for a custom domain. There is no runtime API, form processor, account system, or secret in the browser application.

• A restrictive meta Content Security Policy blocks scripts and object embeds.
• External links use rel="noopener noreferrer".
• No form is used, so the site does not collect visitor data.
• Only public portfolio artifacts are stored in the deployed site.
• A security.txt file provides a disclosure contact.

Some response-level controls, including HSTS and additional HTTP security headers, depend on GitHub Pages. The repository can control page markup and a meta CSP, but it does not claim complete control over every server response header.

The main portfolio risks are accidental publication of private data, unsafe external content, broken dependencies in linked repositories, and inaccurate claims.

If you notice a security issue involving this portfolio, email ejor50k@gmail.com. Do not include unnecessary personal data in the report.