Strict Content Security Policy on a static site

Every page is static and served with a Content Security Policy that allows no inline script or style except inline scripts whose hashes are computed per route at build time, plus HSTS preload, behind nginx and Cloudflare.

implemented

Capped at Implemented: the code, tests and records are private, so this is self-reported and cannot be verified publicly.

deployed

Running in a real, reachable environment I operate.

personal lab

My own projects. Public repositories carry CI-verified evidence; private ones are self-reported.

A personal project whose repository is private and cannot be published. So this claim is self-reported: it stops at Implemented and links to no artifacts.

• aliakbari.dev