Security
Measured, not claimed
If I am going to tell you how to secure your infrastructure, my own should survive the same checks. These are measured against the live site whenever it is updated, and published whatever they say.
13 pass3 warning0 failhelius.dk
This site, measured
The same things a client’s security team or an external scanner would look at. A failure is shown as a failure: a failure in the build stops it from being deployed, and a failure in the live setup stays on this page until it is fixed.
Live checks last measured: Build checks (CSP, third-party resources) at deploy: · 97bd720Raw results as JSON
Transport and headers
- HTTP redirects to HTTPSPasshttp:// answers 301 → https://helius.dk/
- HSTSPassmax-age=31536000; includeSubDomains
- TLS version and certificatePassTLSv1.3 · certificate valid 60 more days
- MIME sniffing disabledPassnosniff
- Referrer-PolicyPassstrict-origin-when-cross-origin
- Permissions-PolicyPasscamera=(), microphone=(), geolocation=(), payment=(), usb=()
- Clickjacking protectionPassX-Frame-Options: DENY
DNS
- DNSSECPasshelius.dk validates (AD bit set by a validating resolver)
- CAA — who may issue certificatesPasshelius.dk: 11 CAA record(s) restrict issuance
- SPFWarningv=spf1 include:_spf.google.com include:_spf.protonmail.ch ~all (softfail; -all is stricter)
- DKIMPassselectors published: protonmail, protonmail2, protonmail3
- DMARCWarningv=DMARC1; p=quarantine (no rua= reporting)
- MTA-STSWarningno MTA-STS policy (inbound TLS not enforced)
This site
- Content-Security-PolicyPassscript-src hash-only, no unsafe-inline (meta)
- security.txt (RFC 9116)PassRFC 9116, expires in 179 days
- No third-party resourcesPassevery script, stylesheet, font and image is served from this site
How this site is built
- Static HTML. There is no server-side code, no database and no login to attack.
- No cookies, no analytics, no tracking pixels, no third-party scripts.
- Fonts are served from this domain rather than a font CDN, so loading a page tells nobody else that you did.
- Every inline script is pinned by hash in the Content-Security-Policy; nothing else may run.
- Contact is plain email. No form collects anything.
Reporting a vulnerability
If you find a security problem in this site or in anything I have published, I want to hear about it. The same contact is listed in /.well-known/security.txt.
- How to report
- Email [email protected] with what you found, how to reproduce it and what you think the impact is. English or Danish.
- What happens next
- I acknowledge within two business days, keep you updated while I fix it, and credit you when it is resolved unless you prefer not to be named.
- Safe harbour
- Good-faith research that avoids privacy violations, data destruction and service disruption will not be pursued legally. Please give me reasonable time to fix an issue before disclosing it publicly.
- Out of scope
- Volumetric denial of service, social engineering, physical attacks, and findings that only restate a missing header already reported on this page.
Tell me what is broken
A short description is enough. Within one business day I will tell you what I think the problem is, roughly how long it takes, and whether you need me at all. Sometimes the honest answer is no.