Step M2: Security checklist - free-subdomain phase

[aberson]

Manual step M2 (operator-run) · Plan: plan.md §11 Step M2

The ~15-minute security checklist for the free-subdomain phase. A static site has almost no attack surface — this is account hardening, not a security program.

Commands

# Account hardening (GitHub web UI):
#  1. GitHub -> Settings -> Password and authentication -> enable 2FA (authenticator app or passkey)
#  2. Repo -> Settings -> Pages -> confirm "Enforce HTTPS" is checked
#  3. Repo -> Settings -> Code security -> confirm Dependabot alerts are on
# Sanity-check no secrets were ever committed:
cd C:\Users\abero\dev\aberson.github.io
git log -p | Select-String -Pattern "api[_-]?key|secret|password|token" -CaseSensitive:$false | Select-Object -First 20

What to look for

Check	Expected
GitHub 2FA	Enabled (authenticator/passkey, not SMS)
Enforce HTTPS	Checked in repo Pages settings
Dependabot	Alerts enabled
Secret scan	grep returns nothing meaningful

Notes

Operator step — no code diff. Explicitly skipped: DDoS protection, server/firewall/DB hardening, WAFs (no server or DB exists).