{
  "schemaVersion": 1,
  "observedAt": "2026-10-07T21:15:38.879Z",
  "completedAt": "2026-10-07T21:15:41.408Z",
  "title": "Griego public website engineering baseline",
  "scope": "Owned public website only: griego.co and www.griego.co. New engineering work observed on the stated date; not historical vulnerability research.",
  "methodology": "Five fixed GET entry points requested sequentially through system DNS, with normal certificate/hostname validation, no credentials/cookies, no TLS bypass, and at most three redirects each. External hosts, credentials, nonstandard ports, downgrade redirects and redirect query strings cause a recorded safety stop. Only selected public headers and bounded security.txt/sitemap bodies are retained.",
  "checks": [
    {
      "id": "https-availability",
      "label": "HTTPS homepage returns HTTP 200 with a valid certificate",
      "status": "pass",
      "observed": "HTTP 200; final URL https://griego.co/; certificate validation true",
      "limitation": "One request chain from one machine; this is not an uptime or TLS-configuration audit."
    },
    {
      "id": "http-redirect",
      "label": "HTTP redirects to the HTTPS apex homepage",
      "status": "pass",
      "observed": "308 http://griego.co/ → https://griego.co/; 200 https://griego.co/"
    },
    {
      "id": "www-redirect",
      "label": "WWW redirects to the HTTPS apex homepage",
      "status": "pass",
      "observed": "308 https://www.griego.co/ → https://griego.co/; 200 https://griego.co/"
    },
    {
      "id": "hsts",
      "label": "HSTS declares one positive max-age",
      "status": "pass",
      "observed": "strict-transport-security: max-age=31536000",
      "limitation": "Header value observed on the final homepage response only; browser enforcement was not tested."
    },
    {
      "id": "nosniff",
      "label": "X-Content-Type-Options is nosniff",
      "status": "pass",
      "observed": "x-content-type-options: nosniff",
      "limitation": "Header value observed on the final homepage response only; browser enforcement was not tested."
    },
    {
      "id": "frame-denial",
      "label": "X-Frame-Options is DENY",
      "status": "pass",
      "observed": "x-frame-options: DENY",
      "limitation": "Header value observed on the final homepage response only; browser enforcement was not tested."
    },
    {
      "id": "referrer-policy",
      "label": "Referrer-Policy is strict-origin-when-cross-origin",
      "status": "pass",
      "observed": "referrer-policy: strict-origin-when-cross-origin",
      "limitation": "Header value observed on the final homepage response only; browser enforcement was not tested."
    },
    {
      "id": "permissions-policy",
      "label": "Permissions-Policy declares empty allowlists for camera, microphone, geolocation and payment",
      "status": "pass",
      "observed": "permissions-policy: camera=(), microphone=(), geolocation=(), payment=()",
      "limitation": "Header value observed on the final homepage response only; browser enforcement was not tested."
    },
    {
      "id": "csp-limited",
      "label": "CSP declares base, object, framing and form restrictions",
      "status": "pass",
      "observed": "content-security-policy: base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'none'",
      "limitation": "This limited CSP is not evidence of XSS prevention or script restrictions; no script-src/default-src requirement is tested."
    },
    {
      "id": "security-contact",
      "label": "security.txt supplies a contact URI",
      "status": "pass",
      "observed": "Contact: mailto:sebastian@sedy.mx",
      "limitation": "Presence and URI syntax only; delivery and mailbox ownership are not tested."
    },
    {
      "id": "security-policy",
      "label": "security.txt supplies an HTTPS policy URI",
      "status": "pass",
      "observed": "Policy: https://griego.co/disclosure",
      "limitation": "The policy URL is not fetched or evaluated. This does not grant testing authorization."
    },
    {
      "id": "security-expiry",
      "label": "security.txt contains one future Expires timestamp",
      "status": "pass",
      "observed": "Expires: 2027-10-01T00:00:00Z; compared with 2026-10-07T21:15:38.879Z",
      "limitation": "Limited field checks; no claim of full RFC 9116 compliance or signature verification."
    },
    {
      "id": "public-sitemap",
      "label": "Public sitemap returns XML with a sitemap root and location entries",
      "status": "pass",
      "observed": "HTTP 200; Content-Type: application/xml; recognizable sitemap root: true; location entries: 7",
      "limitation": "Bounded structural observation only, not XML schema validation, search indexing verification or a crawl of listed URLs."
    }
  ],
  "limitations": [
    "A dated observation from one machine and network; DNS, CDN behavior and deployed content may vary or change.",
    "No exploit attempts, port scans, authenticated requests, form submissions, third-party targets, internal systems or customer data.",
    "Passing these narrow expectations does not establish that a site is secure, compliant, free of vulnerabilities or eligible for any partner program.",
    "The limited CSP observations do not demonstrate XSS prevention or script restrictions.",
    "security.txt checks are limited to contact/policy URI syntax and a future expiry; neither mailbox delivery nor full RFC conformance is verified.",
    "Sitemap checks observe response type and recognizable root/location markup; listed URLs are not fetched and XML is not fully validated."
  ],
  "reproducibility": {
    "runtime": "v24.19.0",
    "requirements": "Node.js 24 or later; built-in modules only; ordinary public network access.",
    "source": "https://griego.co/research/verify-public-baseline.mjs",
    "sourceSha256": "c8fb03ddc79eaa983d697e5de98c46653cdf6802ae347826ff7f12f50a550ffc",
    "command": "node verify-public-baseline.mjs --out ./a-new-observation.json",
    "archivePolicy": "Output is created exclusively and read-only. Existing output is never overwritten; rerun with a new filename.",
    "targets": [
      "https://griego.co/",
      "http://griego.co/",
      "https://www.griego.co/",
      "https://griego.co/.well-known/security.txt",
      "https://griego.co/sitemap.xml"
    ],
    "requestCount": 7,
    "maximumRequests": 20,
    "timeoutMsPerRequest": 15000,
    "maximumRetainedBodyBytesPerResponse": 65536,
    "dnsOverride": false,
    "tlsVerification": true
  },
  "observations": [
    {
      "id": "https",
      "chain": [
        {
          "url": "https://griego.co/",
          "startedAt": "2026-10-07T21:15:38.880Z",
          "status": 200,
          "headers": {
            "content-type": "text/html; charset=utf-8",
            "content-encoding": null,
            "server": "Vercel",
            "date": "Wed, 07 Oct 2026 21:15:39 GMT",
            "strict-transport-security": "max-age=31536000",
            "x-content-type-options": "nosniff",
            "x-frame-options": "DENY",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
            "content-security-policy": "base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'none'"
          },
          "remoteAddress": "216.150.1.1",
          "tlsCertificateValidated": true,
          "completedAt": "2026-10-07T21:15:39.244Z"
        }
      ]
    },
    {
      "id": "http",
      "chain": [
        {
          "url": "http://griego.co/",
          "startedAt": "2026-10-07T21:15:39.244Z",
          "status": 308,
          "headers": {
            "content-type": "text/plain",
            "content-encoding": null,
            "server": "Vercel",
            "date": null,
            "strict-transport-security": null,
            "x-content-type-options": null,
            "x-frame-options": null,
            "referrer-policy": null,
            "permissions-policy": null,
            "content-security-policy": null
          },
          "remoteAddress": "216.150.1.1",
          "tlsCertificateValidated": null,
          "completedAt": "2026-10-07T21:15:39.550Z",
          "location": "https://griego.co/"
        },
        {
          "url": "https://griego.co/",
          "startedAt": "2026-10-07T21:15:39.550Z",
          "status": 200,
          "headers": {
            "content-type": "text/html; charset=utf-8",
            "content-encoding": null,
            "server": "Vercel",
            "date": "Wed, 07 Oct 2026 21:15:39 GMT",
            "strict-transport-security": "max-age=31536000",
            "x-content-type-options": "nosniff",
            "x-frame-options": "DENY",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
            "content-security-policy": "base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'none'"
          },
          "remoteAddress": "216.150.1.1",
          "tlsCertificateValidated": true,
          "completedAt": "2026-10-07T21:15:39.927Z"
        }
      ]
    },
    {
      "id": "www",
      "chain": [
        {
          "url": "https://www.griego.co/",
          "startedAt": "2026-10-07T21:15:39.927Z",
          "status": 308,
          "headers": {
            "content-type": "text/html",
            "content-encoding": null,
            "server": "Vercel",
            "date": "Wed, 07 Oct 2026 21:15:40 GMT",
            "strict-transport-security": "max-age=31536000",
            "x-content-type-options": "nosniff",
            "x-frame-options": "DENY",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
            "content-security-policy": "base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'none'"
          },
          "remoteAddress": "216.150.16.129",
          "tlsCertificateValidated": true,
          "completedAt": "2026-10-07T21:15:40.326Z",
          "location": "https://griego.co/"
        },
        {
          "url": "https://griego.co/",
          "startedAt": "2026-10-07T21:15:40.326Z",
          "status": 200,
          "headers": {
            "content-type": "text/html; charset=utf-8",
            "content-encoding": null,
            "server": "Vercel",
            "date": "Wed, 07 Oct 2026 21:15:40 GMT",
            "strict-transport-security": "max-age=31536000",
            "x-content-type-options": "nosniff",
            "x-frame-options": "DENY",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
            "content-security-policy": "base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'none'"
          },
          "remoteAddress": "216.150.1.1",
          "tlsCertificateValidated": true,
          "completedAt": "2026-10-07T21:15:40.681Z"
        }
      ]
    },
    {
      "id": "security",
      "chain": [
        {
          "url": "https://griego.co/.well-known/security.txt",
          "startedAt": "2026-10-07T21:15:40.682Z",
          "status": 200,
          "headers": {
            "content-type": "text/plain; charset=utf-8",
            "content-encoding": null,
            "server": "Vercel",
            "date": "Wed, 07 Oct 2026 21:15:41 GMT",
            "strict-transport-security": "max-age=31536000",
            "x-content-type-options": "nosniff",
            "x-frame-options": "DENY",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
            "content-security-policy": "base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'none'"
          },
          "remoteAddress": "216.150.1.1",
          "tlsCertificateValidated": true,
          "completedAt": "2026-10-07T21:15:41.023Z",
          "body": "Contact: mailto:sebastian@sedy.mx\nExpires: 2027-10-01T00:00:00Z\nPreferred-Languages: en, es\nCanonical: https://griego.co/.well-known/security.txt\nPolicy: https://griego.co/disclosure\n",
          "bodyBytes": 183,
          "bodySha256": "8154a929f662bcb8764722d97756a439765e5d0bfdd54e1cc2e555c065437680"
        }
      ]
    },
    {
      "id": "sitemap",
      "chain": [
        {
          "url": "https://griego.co/sitemap.xml",
          "startedAt": "2026-10-07T21:15:41.023Z",
          "status": 200,
          "headers": {
            "content-type": "application/xml",
            "content-encoding": null,
            "server": "Vercel",
            "date": "Wed, 07 Oct 2026 21:15:41 GMT",
            "strict-transport-security": "max-age=31536000",
            "x-content-type-options": "nosniff",
            "x-frame-options": "DENY",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
            "content-security-policy": "base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'none'"
          },
          "remoteAddress": "216.150.1.1",
          "tlsCertificateValidated": true,
          "completedAt": "2026-10-07T21:15:41.407Z",
          "body": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<urlset xmlns=\"http://www.sitemaps.org/schemas/sitemap/0.9\">\n<url>\n<loc>https://griego.co</loc>\n<changefreq>monthly</changefreq>\n<priority>1</priority>\n</url>\n<url>\n<loc>https://griego.co/research</loc>\n<changefreq>monthly</changefreq>\n<priority>0.7</priority>\n</url>\n<url>\n<loc>https://griego.co/security</loc>\n<changefreq>monthly</changefreq>\n<priority>0.7</priority>\n</url>\n<url>\n<loc>https://griego.co/disclosure</loc>\n<changefreq>monthly</changefreq>\n<priority>0.7</priority>\n</url>\n<url>\n<loc>https://griego.co/about</loc>\n<changefreq>monthly</changefreq>\n<priority>0.7</priority>\n</url>\n<url>\n<loc>https://griego.co/contact</loc>\n<changefreq>monthly</changefreq>\n<priority>0.7</priority>\n</url>\n<url>\n<loc>https://griego.co/privacy</loc>\n<changefreq>monthly</changefreq>\n<priority>0.7</priority>\n</url>\n</urlset>\n",
          "bodyBytes": 859,
          "bodySha256": "30213502f26321c98d78d663b5966fbfcc0d80c31bc905789e5df82f8ca30c89"
        }
      ]
    }
  ]
}