Security and privacy, in practice
Why /.well-known/security.txt matters, and how to serve it properly
RFC 9116 answers the one question a stranger needs answered about your site: who do I tell about a vulnerability. What the file must contain, why the expiry date belongs in a test, and the routing trap that makes an SPA host serve it as HTML at 200.
2 Aug 2026
·
8 min read
·151 views
Security and privacy, in practice
Four security headers, and the CSP I deferred on purpose
The cheapest security win on a single-container stack lives at the reverse proxy. Here's the four-header Traefik middleware I shipped, the two things I deliberately held back, and the report-only CSP rollout I'm lining up next.
8 Jul 2026
·
6 min read
·96 views