Security

This site's code is public and covered by an MIT licence. You can inspect it by visiting the LucaPipolo/lcp-web repository on GitHub.

The site uses a Content Security Policy and other security headers recommended by the OWASP Secure Headers Project to limit what can be loaded and run on the page. The exact configuration lives in the code (middleware.ts and vercel.json). The site scores an A+ on securityheaders.com.

Traffic to the site passes through Vercel's Web Application Firewall, with the Bot Protection managed ruleset switched on to block illegitimate automated traffic.

The following GitHub security tools are active on the repository: Dependabot flags known vulnerabilities in the site's dependencies and proposes updates for them, secret scanning with push protection automatically blocks attempts to push credentials or keys into the code, and CodeQL analyses the code on every change looking for vulnerabilities.

If you find a security vulnerability, report it through GitHub's private reporting feature: it stays visible only to me until I've fixed it. Alternatively, you can email me at security@lucapipolo.com. You'll find the same contact details, in a format readable by whoever automates this kind of search, in the /.well-known/security.txt file.