Threat-Modeling

2026

• A threat model for a static site November 7, 2026

  A static Hugo site still has a publishing pipeline, credentials, third parties, and readers to protect. I put those risks into an OWASP Threat Dragon model and made CI keep the model tied to controls that actually exist.