// SECURITY · SELF-AUDIT

This site grades
itself, daily.

A read-only Lambda checks the AWS account and the live site against a fixed set of controls every day — no long-lived credentials, locked-down S3, no open security groups, the full set of security headers, a healthy TLS certificate — and publishes the graded result right here.

Loading the latest audit…

One documented exception: a single local-admin IAM user holds an access key for hands-on Terraform. Deploys never use it — CI assumes a role via GitHub OIDC — so it stays off the CI path and out of this grade by design.

Homegrown on purpose: AWS Config would grade some of this for ~$2+/mo. A read-only Lambda does it for near-zero and stays fully transparent. On its very first run it flagged three real gaps — two orphaned world-open security groups and a missing account-level S3 block — which I then fixed. Read the build: Security scorecard write-up →