About this desk

I am Bryan Calabro. I build a small portfolio of single-purpose tools, and one desk per discipline documents how each part of that work is done. This is the security desk.

The standing rule

Every claim here is tied to a check. Where there is no check, the claim is not made, and the page says what it is waiting for.

That is why the header grades page reports what is configured and refuses to report what is served. Those are different claims, and only one of them has been measured.

How it is written

• First person, threat-model voice. Assets, boundaries, what is protected and what is explicitly not.
• Every entry dated.
• The section listing what the design does not protect against is not optional. A threat model that only lists wins is marketing.

What this desk will never carry

• No badge collages. A wall of logos is not a control.
• No certifications I do not hold. I hold none, and this line is the whole of that section.
• No claim of a grade without a named tool, a named version and a date.

The vendors in the boundary

A threat model that does not name its dependencies has not been written.

And the two that are not answered, which are genuine gaps in this model rather than omissions:

Until those two are filled in, the threat model cannot fully describe who controls what is served at a live host, and that is stated on the page rather than skipped.

The design of this desk

Outside the ten-family system the apps use, with its own palette and type pair: charcoal and amber, dark by default, Chivo over IBM Plex Sans. A threat model is read in a room with the lights down.

Both themes are held to 4.5:1 by the same contrast check every app runs.