wizardloop.github.io/src/pages/security.astro at main · WizardLoop/wizardloop.github.io · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
---
import Base from '../layouts/Base.astro';
---

<Base
  title="Security"
  description="How I keep my website simple: static GitHub Pages hosting, local assets, direct contact links and a private way to report security issues."
>
  <section class="wrap prose-page">
    <header class="page-intro">
      <p class="eyebrow">BUILT WITH CARE</p>
      <h1>
        Small surface.
        <br />
        Clear boundaries.
      </h1>
      <p>
        Updated <time datetime="2026-10-28">28 October 2026</time>.
      </p>
    </header>
    <div class="prose">
      <h2>Simple by design</h2>
      <p>
        This website is static HTML, CSS, JavaScript and local media, hosted on
        GitHub Pages. Browsing does not require an account, a password, a bot or
        a backend service. Contact links open Telegram or your email
        application. No form submissions, CAPTCHA requests or profile
        synchronization are processed here.
      </p>
      <p>
        Fonts and visual assets are served with the site. Repository checks
        validate the build, local links, public metadata and basic secret
        patterns. Credentials and private information must never be committed to
        the public repository.
      </p>
      <h2>Practical limits</h2>
      <p>
        Third-party websites you open have their own availability and security
        practices. The website does not control messages after they enter an
        email or Telegram conversation. A link opening successfully does not
        confirm that a message has been delivered.
      </p>
      <p>
        GitHub Pages does not expose arbitrary per-site response-header
        configuration. This source sets a referrer policy, but does not claim a
        custom HTTP Content Security Policy, Permissions Policy or other
        proxy-level protection is active. No additional proxy service is
        required by this version.
      </p>
      <h2>Report a vulnerability privately</h2>
      <p>
        Email <a href="mailto:wizard@wizardloop.com">wizard@wizardloop.com</a>{' '}
        with the affected URL, a short description and safe reproduction steps.
        You can also{' '}
        <a href="https://t.me/wizardloop">contact me on Telegram</a> to arrange
        a private report.
      </p>
      <p>
        Please do not publish credentials, personal information or exploit
        details in a public issue. Use your own test data and avoid disruption.
        There is no promised response time or paid bounty program.
      </p>
      <p>
        The{' '}
        <a href="https://github.com/WizardLoop/wizardloop.github.io">
          website source
        </a>{' '}
        is available for review. Access to that source does not authorize
        testing third-party infrastructure.
      </p>
    </div>
  </section>
</Base>