Security

Runbook · Status board · Postmortems

Check it yourself

I do not publish scanner results as fixed text on this page. Run the checks you care about and read the reports yourself:

• Mozilla HTTP Observatory
• securityheaders.com
• Qualys SSL Labs
• HSTS preload status
• internet.nl (web)
• internet.nl (mail)

What's in place

Each item below is something you can verify independently — not a promise of a particular scanner label.

• TLS 1.2 or newer — SSL Labs or your browser's connection details for https://pagerpete.com.
• HSTS — response headers on any HTML page (see Strict-Transport-Security in public/_headers or live headers).
• Content Security Policy without inline script or style — view source on any public page; shipped HTML uses external CSS and JS only. Compare live Content-Security-Policy to the repo.
• DNSSEC — internet.nl mail/web tests or your registrar's DNSSEC status.
• SPF, DKIM, and DMARC (p=reject) — internet.nl mail test or DNS lookups on the domain's TXT records.
• Public source and CI gates — github.com/petedevop/pagerpete.com is public; workflows under .github/workflows/ run lint, tests, and site checks on every change.
• security.txt — /.well-known/security.txt.

How the site treats visitors

Pages load first-party CSS and JavaScript only. I do not embed analytics scripts, advertising beacons, or other third-party page tags. The optional browser check-up on the home page runs entirely in your browser; it does not send your results to me.

Cloudflare sits in front of the site on the free plan. They terminate TLS, apply my security headers on static assets, and process normal request metadata (IP address, user agent, and similar) as part of operating the edge — the same kind of visibility any reverse proxy has.

What I don't claim

• No formal certification, audit, or penetration test report — this page is my own disclosure.
• One operator (me), not a 24/7 security operations center.
• Hosting on Cloudflare's free tier, with the limits that implies.
• Availability target: the public 99.5% rolling 30-day SLO on the status board, not five-nines marketing.

Reporting a problem

Email pete@pagerpete.com with enough detail to reproduce the issue. The machine-readable contact file is at /.well-known/security.txt.

For uptime and incident context, see the status board, runbook, and postmortem template.