Security posture
This site is designed not to become a problem
A personal cybersecurity site should reduce surface, declare dependencies and avoid collecting unnecessary sensitive information. Defence starts with design.
Updated 3 September 2026.
Minimal surface
- There are no user accounts, sessions or an administration panel on this site.
- There is no visitor database and no storage of incidents.
- The content is static: biography, articles, books and links to sources.
- The site minimises third-party components. Dependencies required for hosting and operation are reviewed periodically and declared where appropriate.
- In preview and in production a Grok platform script is loaded (`https://grok.com/grok-app-builder/extensions.js`). That dependency is declared in the CSP. This page does not claim what that remote script does internally. There is no embedded marketing analytics.
Last review of this page: 4 September 2026.
Contact form
- It does not ask for passwords, banking data or confidential details of an incident.
- The message is posted to this site’s server and delivered by mail to contacto@rafaelnunezaponte.com. Reply-To is the professional address given. Honeypot fields, a minimum completion time, an allow-list of reasons and a resubmission limit.
- Honeypot fields for bots, a minimum completion time and a resubmission limit in the session.
- Length limits, an allow-list of reasons and stripping of control characters.
- The email body is encoded to prevent header injection.
Headers and content policy
- Content-Security-Policy: scripts, images, fonts and connections restricted to the origin and to declared platform origins where appropriate.
- Strict-Transport-Security when the site is served over HTTPS.
- X-Content-Type-Options: nosniff.
- Referrer-Policy: strict-origin-when-cross-origin.
- Permissions-Policy: camera, microphone, geolocation, payments and sensors disabled.
- Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy: same-origin.
- External links with rel="noopener noreferrer".
What this site does not promise
No site is impregnable. TLS encryption, DNS and the edge firewall depend on the hosting when the domain points to production. This page documents real controls in the code, not a marketing seal.
Responsible disclosure
If you find a vulnerability in rafaelnunezaponte.com, write it to contacto@rafaelnunezaponte.com. Public exploitation and third-party data are not requested. The formal channel is at /.well-known/security.txt.