Slim Killer rules

Slim Killer's rules

Status: draft, living list. Six product-and-security rules specific to Slim Killer, in addition to the twelve engineering rules in the Build philosophy (six from OOP, six from DDD). Drawn from building the product and from the November 2026 Hostinger compromise. Keep this list to six — when a seventh wants in, it has to earn its place by retiring a weaker one.

1. Static to the world, dynamic only behind a login. The published site is built HTML with no PHP a visitor can reach. Server code runs only in the control panel at /cp. The public attack surface is thereby reduced to a single, authenticated door.

2. A login edits content, never runs code. Authenticating to /cp grants content changes only — never file execution, never changes to site code, never host access. A stolen login must be a vandalism problem, not a compromise.

3. The repository is the truth; the host is a cache. Every change is a commit, every mistake is a revert, every deploy is the host fetching a built release. Nothing authoritative lives only on the server.

4. One tenant, one boundary. Never share a trust boundary — hosting account, Linux user, or container — between clients. On shared hosting: one site per account. On a shared machine: one container each.

5. Secrets are scoped, short-lived, and out of the web root. Least-privilege tokens, rotated, never broader than one repository. .env, the database and keys are never web-reachable.

6. Assume instant discovery. A site is public the moment it has a TLS certificate (Certificate Transparency logs announce it worldwide). Never rely on an address being unknown; every site is secure from second zero or not at all.