A personal website is a small attack surface, but if I work on security the least I can do is state how this one is run and where to report a problem with it.
Reporting
If you find a vulnerability in this site or anything it serves, emailmax.richter.dev@proton.me — PGP key at /pgp/maxrichter.asc. I read reports personally and usually respond within 72 hours. The machine-readable version of this section lives at/.well-known/security.txt(RFC 9116).
Please don't test with traffic beyond what a browser produces — the site is static, so there is genuinely nothing behind it to find, and the hosting is shared infrastructure that isn't mine to authorize testing against.
What this site is
A fully static build. No server-side code, no database, no user accounts, no cookies, no forms, no third-party scripts, no analytics. Fonts, the 3D model, and every other asset are served from the site's own origin. Transport security and browser hardening are set as HTTP response headers (HSTS, a strict allowlist CSP, frame-deny, COOP/CORP, restrictive Permissions-Policy) — verifiable from the outside with a plaincurl -sI https://richtermax.com.
What this site stores about you
Nothing. The hoster (Vercel) writes standard server logs; details and your rights are in the Datenschutzerklärung.
Verify, don't trust
The source of this site is public atgithub.com/richter-max. What the repo builds is what the server ships.