Principles
Build the boring parts well.
Security does not need theatrical complexity. The goal is to make sensible defaults ordinary, visible and maintainable.
Default secure
Start with the smallest practical attack surface. New functionality should be added intentionally rather than enabled by habit.
Privacy first
Collect less. Avoid tracking pixels, fingerprinting and unnecessary third-party data sharing unless there is a clear, defensible need.
Observable
Use telemetry to understand what reaches the site, what gets blocked and what normal behaviour actually looks like.
Separate experiments from production
Test new infrastructure on a dedicated domain or environment so learning does not create unnecessary risk elsewhere.
Prefer reversible changes
Make changes that can be tested and rolled back cleanly. Security controls should not depend on guesswork or irreversible lock-in.
Understand before automating
Automation is useful once the behaviour is understood. Until then, deliberate manual testing is often the better teacher.
Talk to the project
Contact stays minimal too.
The contact page explains what is and is not enabled while this remains a development environment.