This blog is generated by a single Node script I wrote myself. No framework, no theme, two dependencies (marked and highlight.js) — both of which I can actually read.
Why not Astro / Hugo / Next?
For a security-focused blog the interesting threat isn't runtime — a static site with no inputs has essentially no runtime attack surface. The interesting threat is the build chain: every npm package that runs on my machine at build time is code execution I've delegated to a stranger.
A typical framework install pulls in hundreds of transitive packages. Mine pulls in a number I can audit by hand:
npm ls --all | wc -lHow it works
Posts are markdown files with a tiny frontmatter block:
---
title: My post
date: 2026-07-31
description: One-liner for the index and RSS.
tags: ctf, web
---The generator parses that with ~20 lines of code instead of a YAML library, because a key: value parser is all a blog needs:
function parseFrontmatter(raw, file) {
const m = raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?/);
if (!m) throw new Error(`${file}: missing frontmatter block`);
// ...
}Everything renders to static HTML in dist/: post pages, an index, tag pages and an RSS feed. Cloudflare Pages serves the files; there is no server, no database, no comment box — nothing to inject into.
What's next
CTF writeups, notes from building RFSight, and whatever else survives contact with a weekend.