Built to standard.
How this website is built and kept. Each claim below links to an independent test, so you can check it yourself instead of taking our word for it.
- A+Mozilla ObservatoryAll 12 security tests passed, scoring 145.Run the test (opens in a new tab)
- A+Qualys SSL LabsOn every address, IPv4 and IPv6. TLS 1.2 and 1.3 only.Run the test (opens in a new tab)
- 0Accessibility errorsAutomated WCAG 2.2 A and AA checks, on every page, in both themes.Accessibility statement
- 0HTML errorsThe W3C validator finds nothing to correct, on every page.Run the test (opens in a new tab)
- 100LighthouseAccessibility, best practices and SEO, on mobile and desktop.Run the test (opens in a new tab)
Security
Layered so that no single slip opens the site.
A strict Content Security Policy
No script runs unless its exact fingerprint, a SHA-256 hash, is on the page's list, so injected code has nowhere to run. Inline styles, plug-ins and framing by other sites are refused outright.
Encrypted, always
HTTPS only, over TLS 1.2 and 1.3 with forward secrecy; older protocols are refused. HSTS tells browsers never to try plain HTTP, and sushraj.in meets every requirement of the browsers' preload list and is queued to join it.
SSL Labs (opens in a new tab)HSTS preload status (opens in a new tab)
A signed domain
DNSSEC signs every answer about sushraj.in, so no one can quietly point it elsewhere, and CAA records name the only certificate authorities allowed to issue for it.
Outside code, pinned
Cloudflare's visit counter is checked against its published hash (Subresource Integrity) before it runs. Google Analytics loads only after a visitor agrees.
Nothing to break into
No database, no login and no server of our own: the site is plain files served by Cloudflare, with every response carrying hardened headers.
A door for researchers
A security.txt file (RFC 9116) says where to report a vulnerability: security@sushraj.in.
Speed
Fast on a phone on a slow network, not only on our desks.
Served from the nearest edge
Every page is built ahead of time and served from the Cloudflare data centre nearest the visitor, over HTTP/3 where the browser supports it, on IPv6 as well as IPv4.
Words first, 3D after
The headline is on screen before any script runs. The particle scenes load only as you come near them, the opening mark draws away from the page's main thread where the browser allows, and slow graphics get a lighter version.
Fonts from this site
Both typefaces are served from sushraj.in and sized in advance, so text never jumps when they arrive and no request goes to a font service.
Cached for a year
Every file the build fingerprints is cached for a year and never fetched twice; pages themselves are always fresh.
Accessibility
Built and tested to WCAG 2.2 level AA.
Tested on every release
Every page is checked with axe-core against the WCAG 2.2 A and AA rules before each release, in Safari's and Chrome's engines, on a desktop and a phone, in light and dark.
Keyboard first
A skip link, a visible focus ring on every control, a menu that holds the keyboard while open, and Escape to close anything that opens.
Motion you control
The site honours your device's reduced motion setting, and Display settings can pause everything that moves on its own. The scenes only move when you scroll.
Readable, light or dark
Text meets a contrast of 4.5 to 1 or more. Choose light or dark, or let the site follow your device. Every word is in the page itself, so it reads without JavaScript too.
Privacy
Written to India's Digital Personal Data Protection Act, 2023.
Cookies only if you agree
Google Analytics is not even downloaded until you accept, using Google Consent Mode v2 with every signal denied by default. Cloudflare's visit counts set no cookies. Global Privacy Control is honoured.
No advertising
No ad trackers, no pixels, every Google advertising signal switched off, and nothing sold. The project brief is written on your own device and goes only where you send it.
Open standards
Plain, valid web pages that any browser, search engine or assistant can read.
Valid HTML
Every page passes the W3C validator, with headings in order and landmarks a screen reader can move between.
Described for machines
One schema.org graph tells search engines and AI assistants who we are, what we make and where we are. A sitemap, canonical addresses, robots.txt and llms.txt do the rest.
Rich Results Test (opens in a new tab)Schema validator (opens in a new tab)
Engineering
The same discipline we bring to client systems.
Checked before every release
Linting, strict TypeScript, a house style check and a production build run on every change. Before a release, browser tests run in two engines on a desktop, a tablet and a phone.
Hardened by the build
The build fingerprints every inline script into the security policy and stops if anything would weaken it, such as an inline event handler or style.
Recorded in full
Every change is recorded in Git, and what is live always matches what is recorded.
Results last read on 8 October 2026. The links run each test again, live.