Controls
A control list is worth reading only if it says who checks it and when. A row with a checkmark and no date is decoration.
Every row has a method and a last-checked date. Where the date is the day this desk was first published, that is the first check, not an accumulated record, and we would rather say so.
What we operate
| Control | What we do | How it is checked | Last checked |
|---|---|---|---|
| Transport security | Every host is served over HTTPS only, with HTTP redirected. | Request the host over plain HTTP and confirm the redirect, then read the response headers of the final response. | 2026-09-21 |
| Response headers | Each host sends a content security policy, HSTS, nosniff, a framing rule and a referrer policy. | Read the response headers of each host and grade them against the same checklist every time. | 2026-09-21 |
| Certificates | Each host presents a valid certificate covering its name, with a modern signature and a key of at least 2048 bits. | Decode the served certificate and read the validity window, the subject alternative names, the signature algorithm and the key size. | 2026-09-21 |
| Certificate expiry | No certificate is allowed inside 30 days of expiry without a renewal in hand. | The days remaining are read from the certificate itself rather than from a calendar reminder. | 2026-09-21 |
| Crawler policy | Every host publishes a robots.txt and a sitemap.xml that agree with each other. | Fetch both, then test representative paths against the rules using longest-match precedence. | 2026-09-21 |
| Dependency surface | First-party apps ship no analytics, no third-party scripts and no tracking pixels. | Read the built output and the dependency list for outbound hosts. | 2026-09-21 |
| Secrets | No credentials in the repositories, no tracked environment files. | A deterministic audit script over every tracked file, run in CI on every pull request. | 2026-09-21 |
| Change control | Every change lands through a pull request against a public repository. | The commit history is the record, and it is readable by anyone. | 2026-09-21 |
| Data minimisation | The tools hold state in the visitor's browser and send nothing to a server of ours. | The built bundle is read for outbound requests. There is no backend to audit because there is no backend. | 2026-09-21 |
The tools behind three of those rows
Three of the checks above are being built as tools of their own, so that the method is executable rather than remembered: a response header grader, a certificate decoder, and a robots.txt builder and tester.
They are not linked here yet. Linking a host before it verifies as live is exactly the kind of claim this desk exists to avoid. When each one is live, the row above gains a link to the tool that performs the check, and the change will be a commit like any other.
What we have got wrong
One finding is on the record, and we publish it because a controls page with no failures in it is not a controls page.
On 2026-09-19, during a host verification pass, qr.bryancalabro.com was found to be serving a 404 for its Open Graph image after an icon set had merged (F-1, T-2). The wordless icon and Open Graph set was corrected and re-verified, and the file now returns 200.
A second, softer finding from the same review, covering relative Open Graph URLs and an under-wired apple touch icon, is recorded as noted rather than resolved (F-2). We are not going to write it up as fixed until it is.
What is not in scope
We do not operate a production database, a queue, a customer-facing API or an authentication system, so there are no controls listed for any of them. If that changes, the rows arrive here before the feature ships.