Colophon

This site is a static set of HTML files generated with Hugo. There is no database, no login, no comment system and no form.

What it loads #

Every page loads only from this domain: HTML, one stylesheet, two fonts (Geist and Geist Mono, self-hosted under the SIL Open Font License), the site icons and the images of the post you are reading. There is no JavaScript, no cookie, no analytics and no embedded content from other sites. Links to other sites are plain links with rel="noopener noreferrer".

Cloudflare serves the site and sees the requests, as any host does. I run no analytics of my own. Cloudflare also adds Network Error Logging headers: when a connection to this site fails, your browser may send a short error report to Cloudflare. Successful visits are not reported.

Response headers #

The headers are set at the host from a file in the source:

Content-Security-Policy: default-src 'none'; img-src 'self'; style-src 'self'; font-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; upgrade-insecure-requests
Strict-Transport-Security with a two-year max-age and includeSubDomains
X-Content-Type-Options: nosniff and X-Frame-Options: DENY
Referrer-Policy: no-referrer
Permissions-Policy with the sensor, camera, microphone, payment and USB features switched off
Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy set to same-origin

Build #

Posts are Markdown files in a private Git repository. Every change goes through a build that fails on a script, iframe, object, embed or form in the output, on images, stylesheets or other resources loaded from other domains, on missing images and on leftover placeholders. Hugo is downloaded from its official release and verified against a pinned checksum, and the GitHub Actions used are pinned to a commit. Cloudflare builds and deploys the main branch.

Contact #

Mail goes to contact@bertpractice.nl . Security reports go to security@bertpractice.nl ; see security.txt and the PGP key with fingerprint 1C06 0709 1319 E399 EDC7 8F1F 4EF9 AF16 9FD6 122E.

The posts are written with AI assistance. How I handle that is on the About page .