This page, audited

At build time

• Commita5ea414
• Signaturevalid
• Built2026-09-16 06:11 UTC
• Node24.20.0
• pnpm11.26.0
• Direct dependencies11
• Total resolved478
• Floating ranges0
• Release quarantine7 days
• Build scripts allowedesbuild, lefthook, sharp, workerd
• Actions SHA-pinned6/6

In your browser, right now

• CSP hashes…
• External JS…
• Response headers…

Response headers are served by Cloudflare from public/_headers, so they are absent on the dev server. That is expected, not a failure.

Prowler scan

Prowler audits this repository’s own GitHub configuration. The results below are real and unedited, from the most recent scan.

Failing, and why they are still failing

• highRepository default branch dismisses stale pull request approvals
  repository_default_branch_dismisses_stale_reviews

  accepted riskDepends on a pull-request review workflow, which a solo repository does not run.

• highRepository default branch requires code owner approval for changes to owned code
  repository_default_branch_requires_codeowners_review

  accepted riskCode owner review means reviewing your own code on a solo repository. CODEOWNERS exists so ownership is explicit, but enforcing self-review would be theatre.

• highRepository default branch requires status checks
  repository_default_branch_status_checks_required

  to doCI already runs lint, typecheck, build, audit, gitleaks and a SHA-pin check on every push. Making them a merge gate requires moving to a pull-request workflow.

• highRepository has secret scanning enabled to detect sensitive data
  repository_secret_scanning_enabled

  blockedGitHub only offers secret scanning for public repositories or paid plans. The GitHub API rejects it here with a 422. Gitleaks runs on every pull request instead, which covers the same ground from CI.

• mediumRepository default branch requires conversation resolution before merging
  repository_default_branch_requires_conversation_resolution

  accepted riskDepends on a pull-request review workflow, which a solo repository does not run.

• mediumRepository default branch requires at least 2 approvals for code changes
  repository_default_branch_requires_multiple_approvals

  accepted riskRequires two approving reviews. This is a one-person repository, so a second approver does not exist. Stated rather than hidden.

Passing

• ✓Repository default branch denies force pushes
• ✓Repository default branch protection applies to administrators
• ✓Repository enforces branch protection on the default branch
• ✓Repository default branch requires signed commits
• ✓Repository grants workflows a read-only default GITHUB_TOKEN
• ✓Repository has package vulnerability scanning (Dependabot alerts) enabled
• ✓Repository has immutable releases enabled
• ✓Repository denies default branch deletion
• ✓Repository has a CODEOWNERS file
• ✓Repository is archived or active within the configured inactivity threshold
• ✓Repository deletes branches after pull request merge
• ✓Repository default branch requires linear history

None of this is written by hand: Prowler’s JSON-OCSF is normalized at build time. Failures are shown as they are, with a stated reason, because hiding them would make the page pointless.

Spot the misconfiguration

Three real configurations. Click the dangerous line in each.0/3