Skip to content

Security: mbonne/mbonne.github.io

Security

Report a vulnerability

SECURITY.md

Security Policy

What this site is

buildtestrun.com is a personal static blog hosted on GitHub Pages and proxied through Cloudflare. There is no backend, no database, no authentication, and no user accounts. All content is generated by Hugo at build time and served as static files.

Attack surface

Component Notes
GitHub Pages Serves static files only. No server-side code execution.
Cloudflare Handles TLS, DNS, security headers, and analytics. Cloudflare configuration is not in this repo.
Client-side JS post-enhancements.js (TOC, copy buttons), github-repos.js (GitHub API fetch with HTML escaping), back-to-top.js. All scripts are self-hosted.
Third-party CDNs jsDelivr (Cascadia fonts only).
External APIs api.github.com (public repos, read-only, unauthenticated).

What is in scope

  • Cross-site scripting (XSS) in client-side JavaScript
  • Content injection via GitHub API data (repo names, descriptions) rendered to the DOM
  • Sensitive data exposure (e.g. tokens committed to the repo, credentials in config)
  • DNS or Cloudflare misconfiguration exposing the origin or weakening TLS

What is out of scope

  • Cloudflare platform vulnerabilities (report these to Cloudflare directly)
  • GitHub Pages platform vulnerabilities (report these to GitHub)
  • Third-party CDN content (jsDelivr)
  • Attacks requiring physical access to a device
  • Social engineering
  • Denial of service (the site is behind Cloudflare)
  • Issues only reproducible in browsers with non-default privacy settings

Reporting a vulnerability

Email: developers@buildtestrun.com

Please include:

  • A description of the vulnerability and its potential impact
  • Steps to reproduce, or a proof of concept
  • The URL or component where the issue occurs

You can expect an acknowledgement within a few days. This is a personal project with no SLA, but legitimate reports will be taken seriously and addressed.

There is no bug bounty programme.

Security controls in place

  • HTTPS enforced via Cloudflare (Full Strict mode, HSTS max-age=31536000)
  • DNSSEC enabled
  • Security headers via Cloudflare Transform Rules: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Strict-Transport-Security, Content-Security-Policy
  • X-Powered-By header removed
  • No secrets or tokens committed to this repository
  • GitHub API access is unauthenticated and read-only (public repos only)
  • API-supplied strings are HTML-escaped before innerHTML insertion

Security contact

Also available at /.well-known/security.txt per RFC 9116.

There aren't any published security advisories