graysond.xyz is built as a static site with local browser utilities. The interactive tools create no accounts and send nothing you type to a server. The Chat with Grayson widget is the only place visitor input is collected: if you send a message there, your note, the reply-to you provide, the page, and your approximate country are relayed to a private chat and stored so I can follow up — see the data-handling note.
The interactive tools run in the visitor's browser. Prompt text, passphrase input, hashes, network ranges, and runbook notes should not be sent to third-party services unless the site clearly says so and the product intentionally changes.
The boundary is not about distrusting a particular service — it is that this class of input cannot be withdrawn. A passphrase, or a runbook naming internal hosts, is a permanent disclosure the moment it lands in somebody else's logs, and nobody opening a throwaway browser utility expects to be making that decision. The Content Security Policy is what turns that from something I assert into something the browser enforces: connect-src allows only this origin and a short list of analytics hosts, and form-action is none, so a script on a page here has nowhere it is permitted to send typed input.
Analytics is limited to page views, section navigation, outbound clicks, and tool actions. It should never include text a visitor types into a tool. Typed text is the easiest thing to leak by accident, because an event parameter looks like telemetry rather than data and gets reviewed as though it were. Keeping the vocabulary to which tool was opened and which action was taken, rather than what was put into it, means there is no field for a passphrase to arrive in by mistake.
Deployment secrets, Cloudflare API tokens, account identifiers, and private configuration do not belong in the public repository or public site. A credential that can deploy this site can also replace it, so the cost of leaking one is not lost data — it is this domain continuing to serve whatever the holder decides, from an address people already trust. They live in the shell environment of whichever machine is doing the deploy, because a repository is cloned, forked and cached in ways that make a committed secret impossible to actually take back.
This is not a claim that any website is risk-free. It is the current operating posture: keep the attack surface small, avoid unnecessary collection, disclose the analytics boundary and the chat-contact store, and treat security as part of the release process.
For related operations context, see Technical Operations and IT Documentation.