A public baseline.
Recorded, not assumed.

Purpose and scope

What this review establishes.

This note checks whether the public site returns the behavior and configuration we expect. It records observations on a Griego-controlled asset; it does not establish a history of external engagements or discovered vulnerabilities.

Owned public website only: griego.co and www.griego.co. New engineering work observed on the stated date; not historical vulnerability research.

Five fixed GET entry points requested sequentially through system DNS, with normal certificate/hostname validation, no credentials/cookies, no TLS bypass, and at most three redirects each. External hosts, credentials, nonstandard ports, downgrade redirects and redirect query strings cause a recorded safety stop. Only selected public headers and bounded security.txt/sitemap bodies are retained.

The work was prepared with AI-assisted tooling. Its basis is the dated network observations and downloadable verifier. It is a self-assessment, not an independent attestation.

Recorded observations.

“Pass” means the response met the specific expectation in the verifier at the recorded time. It is not a general security score. The snapshot predates publication of this note, so its sitemap count describes the site as it existed during collection.

HTTP 200; final URL https://griego.co/; certificate validation true

308 http://griego.co/ → https://griego.co/; 200 https://griego.co/

308 https://www.griego.co/ → https://griego.co/; 200 https://griego.co/

strict-transport-security: max-age=31536000

x-content-type-options: nosniff

x-frame-options: DENY

referrer-policy: strict-origin-when-cross-origin

permissions-policy: camera=(), microphone=(), geolocation=(), payment=()

content-security-policy: base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'none'

Contact: mailto:sebastian@sedy.mx

Policy: https://griego.co/disclosure

Expires: 2027-10-01T00:00:00Z; compared with 2026-10-07T21:15:38.879Z

HTTP 200; Content-Type: application/xml; recognizable sitemap root: true; location entries: 7

Reproduce the observations.

Download and inspect the source, then run it with Node.js 24 or later. The target list is fixed to this website, and the verifier uses ordinary requests without credentials, exploit payloads, or TLS bypasses. The output is a new observation; it does not replace this archived snapshot.

Verifier SHA-256:

Limits and open work.

• A dated observation from one machine and network; DNS, CDN behavior and deployed content may vary or change.
• No exploit attempts, port scans, authenticated requests, form submissions, third-party targets, internal systems or customer data.
• Passing these narrow expectations does not establish that a site is secure, compliant, free of vulnerabilities or eligible for any partner program.
• The limited CSP observations do not demonstrate XSS prevention or script restrictions.
• security.txt checks are limited to contact/policy URI syntax and a future expiry; neither mailbox delivery nor full RFC conformance is verified.
• Sitemap checks observe response type and recognizable root/location markup; listed URLs are not fetched and XML is not fully validated.

The CSP observations concern only the listed directives. They do not demonstrate script-origin restrictions or protection from every injection issue. Account MFA, individual access, device security, incident-response readiness, and provider infrastructure were not assessed.

The next planned exercises concern local authorization boundaries and AI tool permissions using synthetic data. Their results will be published separately when work is completed and validated.