Hardening a production portfolio from request to response.

I reviewed my own portfolio to identify practical web-security risks, implemented layered controls, and documented what remains outside the scope. This is a sanitized learning artifact, not an independent certification or penetration-test attestation.

Download redacted report Discuss the audit

Scope

thomasmoran.co and first-party application routes

Approach

Configuration, source, and control review

Outcome

Three findings resolved or mitigated; one limitation open

Methodology

A focused, documented review.

The assessment stayed within systems I own and emphasized repeatable checks, responsible disclosure, and concrete remediation.

1
Defined the authorized scope as the public portfolio and its first-party application routes.
2
Reviewed transport behavior, browser-facing response headers, public information exposure, AI request paths, local file imports, and generated exports.
3
Ranked observations by practical likelihood and impact, then prioritized controls that reduce broad classes of risk.
4
Rebuilt the application and verified the production security-header configuration after remediation.
5
Documented limitations and excluded invasive testing, social engineering, denial-of-service activity, and third-party systems.

Implemented Controls

Defense in depth, kept understandable.

Transport security

Implemented

HTTPS is enforced, HTTP requests redirect to HTTPS, and HSTS instructs supported browsers to prefer encrypted connections.

Browser protections

Implemented

Content Security Policy, clickjacking protection, MIME-type protection, referrer controls, and a restricted Permissions Policy reduce common browser-side risk.

AI endpoint safeguards

Implemented

Both AI routes accept bounded same-origin JSON requests, validate small allowlisted payloads, and use database-backed rate limiting to reduce misuse and automated request volume.

Submission boundaries

Implemented

CSV and JSON imports are type-, size-, schema-, and field-validated in the browser. Exported CSV and Markdown content is neutralized to reduce formula and markup injection risk.

Information exposure

Reviewed

The public report omits credentials, private configuration, detailed exploit steps, and other information that could increase attack surface.

Findings Register

What changed and what remains.

Severity reflects this portfolio's context and is not a substitute for an independent assessment.

ID	Observation	Severity	Status
SEC-01	Missing defense-in-depth response headers	Medium	Resolved
SEC-02	AI endpoint abuse and excessive request volume	Medium	Mitigated
SEC-03	Public disclosure of sensitive audit detail	Low	Avoided
SEC-04	Independent penetration testing not yet completed	Informational	Open

Limitations

Deliberately honest scope.

This was a self-assessment, not an independent penetration test. It did not include destructive testing, denial-of-service activity, social engineering, third-party infrastructure, or a formal compliance audit. Future work includes automated dependency monitoring and an external review.

Professional Practice

Security includes restraint.

The downloadable report is intentionally redacted. Credentials, private configuration, detailed exploit paths, and sensitive operational data are excluded. Questions about the methodology can be discussed directly without publishing unnecessary risk.