Security

Reporting a vulnerability#

If you find a security issue in this site, I want to hear about it. Send a message on Telegram or LinkedIn with what you found, how to reproduce it, and what you think the impact is. I aim to reply within a few days and to tell you what I did about it.

The machine-readable version of this page is /.well-known/security.txt.

Scope#

This policy covers t.kolsto.no only. Eyr Medical, Avoir and the companies I have worked for have their own contacts and disclosure processes; please use those for anything that touches their systems.

Good-faith research is welcome. Do not degrade the service for other visitors, do not access or modify data that is not yours, and give me a reasonable amount of time to fix an issue before publishing it. I will not pursue legal action against research that follows these rules.

How this site is built#

The site is static HTML generated by Hugo and served from Cloudflare Pages. There is no server-side code, no database, no login and no cookies.

• A Content Security Policy is enforced, not report-only. Inline scripts are allowed by SHA-256 hash only; there is no unsafe-inline or unsafe-eval for scripts.
• No third-party scripts. The only external origin is m.avoir.no, the privacy-focused OpenPanel analytics I run myself. Fonts and images are self-hosted. See the privacy policy.
• Transport: HTTPS only, with Strict-Transport-Security set for two years including subdomains.
• Headers: X-Frame-Options: DENY, frame-ancestors 'none', X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Cross-Origin-Opener-Policy: same-origin and a restrictive Permissions-Policy.
• Supply chain: the build runs in a pinned Hugo container on my own CI. Every build validates the HTML and checks that each internal link, asset and fragment resolves before anything is published.

Check it yourself at securityheaders.com or Mozilla Observatory.

Last updated: October 2026