Security

Reporting a vulnerability

Please report suspected vulnerabilities privately to henoriega@icf.unam.mx. Include the affected URL, reproduction steps, and potential impact. Do not include visitor records or exploit other visitors while testing.

Architecture

The public portfolio is a static Jekyll site on GitHub Pages. The public /calendar/ page is rendered from _data/calendar.json and requires no password. Visitor analytics are handled by a Cloudflare Worker backed by D1. The Worker’s legacy authenticated calendar API remains independent of the public page.

The Worker is the security boundary for private information. It uses strict origin checks, scoped short-lived bearer tokens, rate limiting, bounded JSON parsing, allowlisted event types and URLs, prepared SQL statements, defensive response headers, and no-store caching.

Full visitor IP storage is intentionally enabled. Access to those records is restricted to the authenticated analytics API and dashboard.

Operational requirements

• Keep Wrangler local state, D1 files, .env files, and .dev.vars out of Git.
• Keep STATS_SECRET stable when IP-hash continuity is required.
• Rotate AUTH_SECRET to invalidate all dashboard and calendar sessions.
• Use separate high-entropy values for STATS_PASSWORD and CALENDAR_PASSWORD while the legacy calendar API is enabled.
• Review Dependabot alerts and the scheduled security workflow.
• Only public calendar events belong in _data/calendar.json. Do not put credentials, private event details, API tokens, or visitor data in the static site repository.