• Authentication — session-based. The password is compared with hash_equals() (timing-safe) and stored as a constant in admin-config.php, which is git-ignored and outside version control.
• Backups — write_data() snapshots data.json to backups/ before every save (last 5 kept), so a bad edit is always one restore away.
• Output escaping — all admin-side output passes through htmlspecialchars() (h() helper). Frontend rendering escapes with a dedicated esc() before injecting into the DOM.
• File uploads — the CV upload accepts PDF only (accept + MIME check on the client) and writes to a fixed filename (cv.pdf), preventing path traversal.

1. Change ADMIN_PASS — never deploy the sample password.
2. Serve over HTTPS only.
3. Deny web access to backups/ and admin-config.php (web-server rules or placement outside the docroot).
4. Keep admin-config.php out of git (already in .gitignore).
5. Restrict admin.php with basic auth or an IP allowlist if exposed publicly.

Open an issue, or reach out via the GitHub profile. Please do not disclose vulnerabilities publicly before a fix is released.