Work / 000

Belo.sh

A production website designed to reflect the same engineering principles Belo applies to client systems.

Context

A public site should behave like the systems it describes.

Belo.sh is a small, source-controlled publishing system with prerendered public routes, controlled dependencies, explicit ownership, and visible cost constraints. Its structure separates Services, Work, and Labs: consulting delivery, verified evidence, and reusable open engineering.

Architecture

A deliberately small delivery path.

Source

Repository and content under Belo control.

Build

Static HTML, route metadata, JSON-LD, and sitemap are emitted at build time.

Delivery

Cloudflare Pages serves production; preview builds remain noindex.

Security practices demonstrated

Controls appropriate to this documented scope.

Content Security Policy
HTTPS enforcement and HSTS
Clickjacking protection
MIME-sniffing prevention
Strict referrer policy
Turnstile abuse protection
Static prerendering
Restricted dependency surface
Source-controlled deployment
Ownership of domain, code, deployment, and operational documentation

These controls demonstrate secure-by-design implementation for this site's documented scope. They do not represent a formal penetration test, compliance certification, or guarantee that the application is vulnerability-free.

Ownership and boundaries

Control is explicit; dependencies are explicit too.

Belo controls the domain, source, design, content, and deployment configuration. Cloudflare Pages, Turnstile, and Web Analytics are named external dependencies. Security Engineering & Hardening is integrated into delivery, but this case study does not claim an established cybersecurity portfolio.