How I keep your code and data safe

My devices and accounts

• Encrypted and locked

  Full-disk encryption on every machine, automatic lock when I step away, a work machine that nobody else uses. No client code on shared or personal devices.

• Updated as they ship

  Operating system, browsers, runtimes and tools take updates when they are released. Security advisories for the dependencies I use get a same-day look.

• One password manager, MFA everywhere

  Unique generated passwords, multi-factor authentication on every account that offers it, hardware keys where supported.

• One browser profile per client

  Sessions, extensions and cookies stay separate. A client’s admin panel never shares a profile with anything else.

• Encrypted backups

  Backups of my own work are encrypted at rest. Your code is never backed up outside your repository unless we agree on it.

• Nobody else

  No subcontractors, no assistants, no shared logins. The person with access is the person you talked to.

Secrets and access

• Secrets live in the platform

  Environment stores and secret managers, never in code, never in a chat with a model, never in a screenshot. Local secrets sit in files outside version control.

• Least privilege, your accounts

  I use accounts you create and control, scoped to the job, separate from anyone else’s. You can revoke them in one click and you should when we are done.

• Production is not a workstation

  No production access from development machines. Migrations, configuration and fixes go through code and review, never by hand on a live system.

• Offboarding

  At the end: access handed back, local copies deleted, confirmation in writing. If you want a list of what I had access to, you get one.

How I build

• Gates the agents cannot skip. Lint, tests and security checks run in CI on every change. A human reviews every pull request, including the ones an agent opened.
• Security headers by default. Content Security Policy without inline scripts, nosniff, referrer and permissions policies. This website is built that way; you can check its headers in your browser.
• Staging before production. Every change is seen running somewhere that is not production first. Migrations are rehearsed on a clone, then repeated with the same steps.
• Same-day response to advisories. When a vulnerability in a dependency becomes public, the patch ships the same day. The React2Shell response in my work I can show is one example.
• Caps and kill switches. Rate limits, cost budgets with an atomic gate and an emergency stop on every paid service. An abandoned request should not cost you money or data.
• Minimal logging, masked data. Logs hold what debugging needs and nothing personal. Analytics gets anonymized or masked data. Backups and point-in-time recovery are set up and tested, never assumed.
• Email that cannot be spoofed. My domain publishes SPF with a hard fail, DKIM and DMARC with a reject policy. The free SPF, DKIM and DMARC checker shows how yours looks.

This website

Runs on Cloudflare Workers with a Content Security Policy that forbids inline scripts, no third-party scripts and no CDNs. Analytics is PostHog in the EU, loaded through a first-party proxy, with no cookies and with every input masked in session replays. Admin panels sit behind Cloudflare Access. The source of the main site and of the agent skills is public on GitHub. What is collected and why is on the privacy page.

Report a vulnerability

Found something in a page or tool under ciunkos.com? Email me, or use the security.txt file (RFC 9116). You get a reply within 24 hours on working days and a fix as fast as the issue deserves. There is no bug bounty. Please do not test systems that are not mine and do not touch other people’s data; a proof of concept against your own account is plenty. Credit in public if you want it.

Compliance experience

• CASA Tier 2

  I led the Cloud Application Security Assessment (OWASP ASVS based) for a product that integrates with Google Workspace, and I am going through the reassessment now.

• GDPR in practice

  Data processing agreements, records of processing, data minimization, retention limits and deletion flows, shipped in products I built.

• Buyer security questionnaires

  SSO, SCIM, audit logs and the answers enterprise buyers ask for, shipped in products that had to pass them. The facts about me are in the trust center.