Hugo site now

src/content/security.html

@@ -0,0 +1,73 @@
+---
+title: "cspresso Security"
+description: "Security notes for cspresso: it runs a real browser; what bypassing existing CSP means; and how to use it safely."
+---
+<main class="py-5">
+  <div class="container">
+    <header class="mb-4">
+      <div class="kicker mb-2"><i class="bi bi-shield-lock"></i> Security</div>
+      <h1 class="display-6 fw-800 mb-2">Security notes</h1>
+      <p class="text-secondary mb-0">
+        cspresso runs a real browser. That’s the point - and also the main safety consideration.
+      </p>
+    </header>
+
+    <div class="row g-12">
+      <div class="col-lg-12">
+        <section class="mb-12">
+          <h2 class="section-title fw-bold">What cspresso does</h2>
+          <p class="text-secondary">
+            cspresso launches Chromium via Playwright and loads your target pages. The site’s JavaScript and CSS execute like a normal browser session.
+            Network requests are observed to build a draft CSP, and (optionally) a candidate policy is injected as Report‑Only to capture violations.
+          </p>
+        </section>
+
+        <section class="mb-12">
+          <h2 class="section-title fw-bold">About <code>--bypass-csp</code></h2>
+          <div class="callout p-4">
+            <div class="fw-semibold mb-2">It can change risk</div>
+            <div class="text-muted">
+              Bypassing CSP strips existing CSP headers on HTML responses. This option is provided in order to avoid the outcome of the rendering negatively influencing what cspresso thinks a good CSP should be.
+              If a site is compromised, CSP might have been limiting what injected scripts could do (that's the whole point of a CSP!); bypassing removes that layer.
+            </div>
+            <hr>
+            <div class="small text-secondary">
+              Recommendation: only use <code>--bypass-csp</code> on sites you trust, or run cspresso inside a sandboxed environment (VM/container).
+            </div>
+          </div>
+        </section>
+
+        <section class="mb-12">
+          <h2 class="section-title fw-bold">Data handling</h2>
+          <p class="text-secondary">
+            cspresso’s primary output is a policy string and metadata (visited URLs, notes, and - in evaluation mode - detected violations).
+            Treat the output as sensitive if your site URLs or CSP reveal internal endpoints.
+          </p>
+        </section>
+
+        <section>
+          <h2 class="section-title fw-bold">Hardening tips</h2>
+          <div class="row g-3">
+            <div class="col-md-6"><div class="callout p-4 h-100">
+              <div class="fw-semibold mb-2">Prefer CI / disposable environments</div>
+              <div class="text-muted">Running in CI makes it easy to isolate and to cache Chromium via <code>--browsers-path</code>.</div>
+            </div></div>
+            <div class="col-md-6"><div class="callout p-4 h-100">
+              <div class="fw-semibold mb-2">Limit crawl scope</div>
+              <div class="text-muted">Keep <code>--max-pages</code> small and start from a stable landing page to reduce surprises.</div>
+            </div></div>
+            <div class="col-md-6"><div class="callout p-4 h-100">
+              <div class="fw-semibold mb-2">Review before enforcing</div>
+              <div class="text-muted">cspresso emits a draft. Tighten directives (especially <code>script-src</code>/<code>connect-src</code>) and consider nonces.</div>
+            </div></div>
+            <div class="col-md-6"><div class="callout p-4 h-100">
+              <div class="fw-semibold mb-2">Verify releases</div>
+              <div class="text-muted">mig5 key: <a class="link-secondary" href="https://mig5.net/static/mig5.asc" target="_blank" rel="noreferrer">https://mig5.net/static/mig5.asc</a><br>Fingerprint: <code>00AE817C24A10C2540461A9C1D7CDE0234DB458D</code></div>
+            </div></div>
+          </div>
+        </section>
+      </div>
+
+    </div>
+  </div>
+</main>