Verify

Don't take my word for any of it.

Every portfolio asks to be believed. This page hands you the commands instead.

Below is each claim on this site that can be checked from outside, and what to run to check it. If any of them returns something other than what is written here, that is a defect and I want to know — paulmk2143@gmail.com.

Checks you can run right now

Nothing here needs an account or a key

The Content-Security-Policy is what the home page says it is

curl -sI https://paulappsec-site.paulmk2143.workers.dev | grep -i content-security-policy

Expect: default-src 'none'; script-src 'none'; style-src 'self' …

This site ships no JavaScript at all

curl -s https://paulappsec-site.paulmk2143.workers.dev | grep -c '<script'

Expect: 0

All nine security headers are served, not just claimed

curl -sI https://paulappsec-site.paulmk2143.workers.dev

Expect: HSTS, nosniff, DENY, Referrer-Policy, Permissions-Policy, COOP, CORP, COEP

Kartly has a fix branch for every one of its 24 bug classes

git ls-remote --heads https://github.com/PaulAppSec/kartly | grep -c 'refs/heads/fix/'

Expect: 24

The Semgrep rules pass their own fixtures

git clone https://github.com/PaulAppSec/semgrep-appsec-rules && semgrep --test rules/

Expect: 4 rules, 4 fixtures, 0 failures

The rule cited on the projects page exists and is JavaScript, not Python

curl -s https://raw.githubusercontent.com/PaulAppSec/semgrep-appsec-rules/main/rules/a10-exceptional-conditions/fail-open-catch.yaml | head -3

Expect: id: fail-open-catch · languages: [javascript, typescript]

Vulnerability reports have a machine-readable contact, per RFC 9116

curl -s https://paulappsec-site.paulmk2143.workers.dev/.well-known/security.txt

Expect: Contact, Expires, Preferred-Languages, Canonical

robots.txt is valid for crawlers — even though Lighthouse says it is not

curl -si https://paulappsec-site.paulmk2143.workers.dev/robots.txt

Expect: 200 · text/plain · User-agent, Allow and Sitemap lines

Lighthouse marks this file invalid and docks the SEO score for it. That is not the file: Lighthouse requests it from inside the page, and this site’s Content-Security-Policy forbids the page from making network requests of its own. The policy blocked a Google tool, which is what it is for. Search engines fetch robots.txt directly, outside any page, and receive the response above.

Graded by someone else

Third-party scanners, run against the live origin

Independent security scanners and what they reported for this site
securityheaders.com ↗	Grade A+ when last run. Re-run it; the grade is theirs, not mine.
Mozilla HTTP Observatory ↗	Scored 135/100, 10 of 10 tests passed. Its SRI line reads “not needed since site contains no script tags”.

What you cannot verify here, and why

ParkSense is private. It is a commercial product that has not launched, so the 486 tests, the 19 migrations and the ~36,000 lines are claims you have no way to check from outside. I would rather say that plainly than let a number sit on the site implying otherwise.

On a call I will share the screen and run the suite in front of you. That is the honest version of proof for a closed repository, and it is available to anyone seriously considering hiring me or the work.

ParkSense is not field-proven. The recognition loop has been run end to end against a real camera, reading real plates into real sessions — but not at a gate, and not against weather, mounting angles or moving vehicles. It has taken no payment and served no user. Every number about it is a claim about code, and no amount of test coverage closes the gap to the physical world.

Ask me to run it in front of you See the projects