Security Implementation
This page showcases the security measures implemented on this portfolio site. As a security professional, I believe in practicing what I preach â building secure applications from the ground up.
Security Rating Target
A+ on SecurityHeaders.com & SSL Labs
Security Headers & Protections
Content Security Policy
ImplementedStrict CSP with nonce-based script execution
default-src 'self'Nonce-based inline scriptsExplicit allowlist for GiscusNo unsafe-eval
HTTPS Only
ImplementedTLS 1.2+ with HSTS preload
Strict-Transport-Security enabledmax-age=31536000includeSubDomainspreload directive
XSS Protection
ImplementedMultiple layers of XSS prevention
X-Content-Type-Options: nosniffReact auto-escapingCSP script restrictions
Clickjacking Protection
ImplementedFrame embedding prevention
X-Frame-Options: DENYframe-ancestors 'none'
Privacy Controls
ImplementedRestricted browser permissions
Permissions-Policy headerCamera/Microphone disabledGeolocation disabledInterest-cohort disabled (FLoC)
Referrer Policy
ImplementedControlled referrer information
strict-origin-when-cross-originPrevents information leakage
Security Architecture
Defense in depth approach with multiple security layers protecting the application.
CDN & Edge Security
Layer 1First line of defense at the edge
Transport Security
Layer 2Secure data in transit
HTTP Security Headers
Layer 3Browser security policies
Application Security
Layer 4Code-level protections
Cookie Isolation
Layer 5Cross-domain protection
Shadow Twin Architecture
This main site (minhcyber.com) implements security best practices. The Lab Site (lab.minhcyber.com) intentionally contains vulnerabilities for educational purposes and is completely isolated from this site.
Content Security Policy
CSP is a security layer that helps detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks.
default-src 'self'; script-src 'self' 'nonce-{random}' https://giscus.app; style-src 'self' 'unsafe-inline'; frame-src https://giscus.app; connect-src 'self' https://api.github.com; img-src 'self' data: https:; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests (enabled)Learn More
Disclaimer
Security is an ongoing process, not a destination. While this site implements current best practices, the security landscape constantly evolves. The measures shown here represent a point-in-time implementation and are regularly reviewed and updated.