Security

Reporting a vulnerability

If you find a security issue on yasirhassan.tech, I'd like to hear about it. Please email yasirb169@gmail.com with:

• the page or file affected,
• what you found and why it matters,
• the steps to reproduce it.

I usually reply within a day. Please give me a reasonable chance to fix the issue before sharing it publicly, and don't access other people's data or disrupt the site while testing. I'm a student, so there's no bug bounty, but I'll gladly credit you here if you'd like.

The machine-readable version of this policy is at /.well-known/security.txt, following RFC 9116.

How this site is protected

• Static and minimal. The site is plain HTML, CSS and JavaScript on GitHub Pages, served over HTTPS. There's no server-side code, database or login to attack.
• Strict Content Security Policy. Scripts, styles and fonts may only load from this site, with no inline scripts or styles. Plugins are blocked, and forms can only submit to this site and the contact-form service.
• No trackers or cookies. There are no advertising scripts, analytics are switched off, and fonts are self-hosted, so visiting doesn't share your data with third parties.
• Safe by construction. The terminal on the home page writes all output as plain text, so nothing typed into it can inject code into the page.
• Spam-resistant contact form. It sends through Formspree and includes a hidden honeypot field that catches simple bots.

Known limitations

GitHub Pages doesn't let sites set their own HTTP security headers, so the Content Security Policy is delivered through a <meta> tag. That means protections that only work as headers, such as Strict-Transport-Security and frame-ancestors, aren't in place yet.