Security
- Two locks on a static siteThis site is static, but it has a private studio where I write and keep documents. It is guarded twice: once at the edge by an identity service, and again inside the code by checking the signed token myself. Why one lock is not enough, and the ten tests that prove the second one.
- Zero inline scripts, and the six things that broke on the wayThis site runs under a Content Security Policy that only allows scripts from its own files. Getting there took six fixes, most of them in places I did not expect: the build tool, a syntax highlighter, a page-turn library and a diagram renderer.
- Isolation is not a promptRunning one agent framework for several users, I hit session and memory leaking between instances. The fix was not a better system prompt. It was operating-system isolation and a small control plane.