How this site is secured

Checked with claude-security-skills

This is my set of security checks for Claude Code (see projects). Here it ran against this site's source and headers.

secret-scanner

1 hit: a mining-pool URL with a wallet address in the Sakura writeup. I checked it by hand: it is public data from the OSINT task, not a credential of mine. A false positive, left in place.

dependency-check --online

16 known advisories in Next.js 16.2.7, the version the site was built with. I updated it to 16.4.2 and pinned every dependency to an exact version. Now 0, and npm audit agrees.

http-sec-audit

1 medium finding: 'unsafe-inline' in the CSP. It only applies to styles, because React writes inline style attributes; an inline script still can't run without a matching hash. I accept this one. Two informational notes (no COEP, no Cache-Control on pages) don't matter for a public static site.

sast-lite

Not applicable: it reads Python, and the site is TypeScript.

Content Security Policy

The CSP is the main protection against injected scripts. Scripts may only come from this domain. Next.js puts about twenty small inline scripts into the pages; at build time a script of mine hashes each one with SHA-256, and the policy allows exactly those hashes. The site can't be framed, plugins are blocked, and forms can only submit back here.

The sky map was the hard part. The first test under the new policy broke it twice: Aladin Lite loads its WebAssembly core from a data: URL, and on start it pings several mirror servers around the world to pick the fastest. Allowing every mirror would mean a long list of servers I don't control, so I pointed the map straight at the CDS servers in Strasbourg. I also moved the library itself from a CDN to this server, after checking that jsDelivr and unpkg serve a byte-identical file (SHA-256 bed9c8ef…). No third-party script runs in these pages now. YouTube videos load only after a click, inside an isolated frame from youtube-nocookie.com.

Other headers

Strict-Transport-Security

Browsers use only HTTPS for this domain, for two years after a visit.

X-Content-Type-Options

The browser doesn't guess file types, so an image can't be run as a script.

X-Frame-Options

No other site can put this one in a frame. Same as frame-ancestors in the CSP, for older browsers.

Referrer-Policy

Sites I link to see only the domain, not which page you came from.

Permissions-Policy

Camera, microphone, geolocation, payments and USB are switched off.

Cross-Origin-Opener / Resource-Policy

Other sites can't get a handle to this window or load its files.

You can check this yourself with Mozilla Observatory or securityheaders.com.

Domain and mail

PRISM's scan of this domain found no SPF record, so anyone could send mail pretending to be @golubevsavelii.space. The domain sends no mail at all, so the records now say exactly that: SPF v=spf1 -all and DMARC p=reject.

Where to report a vulnerability is in security.txt, following RFC 9116. HTTPS certificates are issued and renewed by Caddy in front of the site container, and the web server hides its version in responses.

What this doesn't cover

This page is about the site, not the VPS under it: SSH, Docker and the OS are out of scope here. The sky map background comes from CDS servers; if they served a tampered image, the worst it could do is show the wrong sky, since images can't run code under this policy.