TRUST / SECURITY
Security
Last reviewed: 9 August 2026
Secure-by-default website foundation
This portfolio is deliberately lightweight. It does not include third-party JavaScript libraries, advertising pixels, analytics trackers or external font services. Static assets are served from the same site to reduce third-party dependency and mixed-content risk.
Browser protections
The Vercel deployment configuration includes a restrictive Content Security Policy, clickjacking protection, MIME-sniffing protection, a strict referrer policy, limited browser permissions, cross-origin isolation headers and HSTS for HTTPS deployments.
Secrets and API keys
Private API keys, OAuth client secrets and server credentials must never be embedded in this public frontend. Projects that need private credentials should use a server-side environment with access controls and appropriate secret management.
Google developer use
Production apps using Google OAuth should use domains the operator owns, a public homepage, same-domain privacy and terms links, secure redirect URIs and only the scopes genuinely required for the app. If a future ShonkiDeveloper app accesses Google user data, its disclosures must be updated before production use.
Responsible disclosure
If you believe you found a security issue affecting this website, contact shonkidevelopers@gmail.com with enough detail to reproduce the issue. Please avoid privacy violations, destructive testing, social engineering or service disruption. This notice does not create a paid bug-bounty program.