jwright c1db5cec86 M4: security pass — strict CSP, header split, build-time scan ...

All JS moved to external /site.js → script-src 'self' with no inline JS,
hashes or eval. Full header set via nginx (CSP, nosniff, frame-deny,
referrer, permissions, COOP/CORP); HSTS stays at the CF edge. Shared
headers include avoids the location add_header reset footgun. Build-time
secret/inline-script/third-party scan gate. SECURITY.md documents posture.

2026-06-17 17:12:57 +10:00

..

build-image.sh

Initial portfolio site: Astro + Tailwind MVP

2026-06-17 16:22:53 +10:00

check-build.sh

M4: security pass — strict CSP, header split, build-time scan

2026-06-17 17:12:57 +10:00

gen-og.mjs

Populate site with real CV data; restyle OG subtitle

2026-06-17 16:44:03 +10:00