Security
Every claim on this desk is tied to a check. Where there is no check yet, the claim is not made.
The threat model
The assets, the trust boundaries, and what is local-only, with how each local-only claim was verified. This is the one page here that is complete, because it describes code that exists.
Header grades and certificates
Not measured. The tools that produce those grades are not live, and I am not grading headers by eye.
Breach and hash checks already shipped
Two live surfaces, and the property that makes one of them safe to use.
What is live
- Breach, which checks whether a password appears in the Have I Been Pwned Pwned Passwords corpus
- Cipher Score, which analyses password strength in real time with entropy-based crack time estimates
Headers, cert, otp and redact are not live, so they are not linked.