Security

Reporting a vulnerability

Please report suspected vulnerabilities privately to henoriega@icf.unam.mx. Include the affected URL, reproduction steps, and potential impact. Do not include visitor records or exploit other visitors while testing.

Architecture

The public portfolio is a static Jekyll site on GitHub Pages. Visitor analytics and private calendar data are handled by a Cloudflare Worker backed by D1.

The Worker is the security boundary for private information. It uses strict origin checks, scoped short-lived bearer tokens, rate limiting, bounded JSON parsing, allowlisted event types and URLs, prepared SQL statements, defensive response headers, and no-store caching.

Full visitor IP storage is intentionally enabled. Access to those records is restricted to the authenticated analytics API and dashboard.

Operational requirements

• Keep Wrangler local state, D1 files, .env files, and .dev.vars out of Git.
• Keep STATS_SECRET stable when IP-hash continuity is required.
• Rotate AUTH_SECRET to invalidate all dashboard and calendar sessions.
• Use separate high-entropy values for STATS_PASSWORD and CALENDAR_PASSWORD.
• Review Dependabot alerts and the scheduled security workflow.
• Do not put credentials, calendar events, API tokens, or visitor data in the static site repository.