An internal, rebuild-driven security posture page for the current site. This is a static-source review of the repo and generated page patterns, not a penetration test or infrastructure assessment. It is designed to update automatically as code and content improve.
This page reviews source fragments, shared templates, head content, and generated page patterns that affect the security posture of the public-facing site build. It focuses on issues that can be observed and tracked directly in the repo.
It does not test infrastructure, authentication systems, hosting configuration, WAF rules, DNS, TLS setup, or server-side controls. The build currently contains 136 generated pages in scope for this source-level review.
129 public pages currently build without any visible Content-Security-Policy declaration in page head content.
Without a CSP strategy, the site has weaker protection against script injection, third-party asset abuse, and accidental expansion of executable content.
374 target="_blank" links were found across 31 source pages without rel protection.
Missing rel attributes weaken link isolation and can create opener-related security and privacy issues when external destinations are opened.
23 inline script block and 0 inline event handler patterns were found across 6 source pages.
Inline JavaScript increases XSS exposure and makes it harder to lock down the site with a stricter Content-Security-Policy later.
0 insecure HTTP links and 0 javascript: URLs were found in source fragments.
These are simple but important hygiene checks. Keeping them at zero prevents obvious browser security and trust problems from creeping into the site.
The current source fragments do not contain plain HTTP href or src targets.
The current source fragments do not expose javascript: href or src patterns.
Move toward a Content-Security-Policy delivered through hosting or a shared template strategy, then use this page to watch the uncovered page count shrink.
Normalize all external links that open new tabs so they consistently include safe rel attributes and remain easy to audit.
Convert inline scripts and on* handlers to shared scripts and more explicit behavior hooks so future CSP hardening is realistic.
After source cleanup, run a browser and hosting review for headers, cookie behavior, third-party requests, caching, and external dependency exposure.
