DevSecOps
Approach and security
We apply to our own site what we offer our clients: prove rather than claim.
The path of a change
A change
Every code change goes through the same pipeline.
Scans
Secrets, dependencies and code are scanned.
Tests
Types, style rules and tests, including integration against a real database.
A hardened image
Minimal, unprivileged, scanned container.
Going live
Only if everything is green.
A DevSecOps method
Security is a delivery step, not a final check.
- Secret, dependency and code scanning on every change.
- Integration tests against a real database for anything that stores data.
- Minimal, unprivileged containers, scanned before every release.
- Fast updates of components when a security fix is published.
What this site respects
These commitments can be checked in how the site is built:
- No third-party scripts, no trackers, no cookies.
- A strict content security policy, with no unauthorised inline code.
- Fonts and images hosted on the site itself.
- Pages usable by keyboard and screen reader (WCAG 2.2 AA target).
- A budget under 300 KB per public page, set as a target.
Honesty
We publish no reference, testimonial or figure that we cannot prove. A project in progress is called “in development” or “in pilot”.