How this site is built

This site makes no requests to anyone but its own origin. No analytics, no font CDN, no embedded widgets. That is a deliberate property, and it is cheap to verify:

grep -rE 'https?://' dist/ | grep -v 'gh0st3k.pages.dev'

If that ever returns a script or a stylesheet, something regressed.

why it matters

Every third-party origin a page touches is a party that can see who read it and when, and a party whose compromise becomes your compromise. A font CDN is a script-execution context you do not control. For a site that will mostly host security writeups, importing that risk to save a few hundred kilobytes is a bad trade.

The fonts are @fontsource packages installed from npm and bundled at build time, so they ship from the same origin as everything else.

the stack

Astro, building to static HTML. No adapter, no server, no database. The output is a directory of files, which means the deploy surface is a bucket and the runtime attack surface is close to nothing.

Posts are MDX in a content collection with a typed schema, so a malformed frontmatter field fails the build rather than rendering a broken page in production.

the hexdump

The front page heading is a real hexdump, generated at build time from the tagline string. The offsets and bytes are computed, not typed by hand, so they cannot drift out of sync with the words:

const bytes = Array.from(new TextEncoder().encode(padded));

The ASCII column carries the actual sentence. Read the right-hand side and you get the same message as anyone else; read the middle and you can check my work.

what is deliberately missing

There is no comment system, no newsletter capture, and no share buttons. Each of those is a third-party origin, and none of them makes a writeup better.