Security

Security policy

Reporting a vulnerability

If you believe you have found a security issue in this website or its source repository, please report it privately rather than opening a public issue. A confidential issue on the GitLab project (tick “This issue is confidential”) is preferred. A dedicated security contact address will be published here and in /.well-known/security.txt once confirmed.

Please include a description, reproduction steps and the impact you believe the issue has. Reports are acknowledged as quickly as possible.

Scope

• sachinchaurasiya.com and its subdomains
• The source repository and its deployment configuration

Out of scope: denial-of-service testing, social engineering, and findings in third-party services (Cloudflare, GitLab) — report those to the vendor.

How this site is protected

• Fully static output — no server-side code paths, databases or user accounts.
• Hash-based Content Security Policy, HSTS, frame-ancestors 'none' and other hardening headers.
• Dependencies, configuration and source are audited and scanned with Trivy before every change is merged.
• Production is built and deployed only from the protected main branch by Cloudflare Workers Builds; GitLab hosts the source, runs no pipeline and holds no deployment credential.
• Served through Cloudflare with TLS 1.2+ and Full (strict) origin encryption.