This is the reading layout
Headings, body, lists, code, and a callout, set the way a real post will be set. The words are about the layout, not about a vulnerability.
Template page. Nothing here is a disclosure. It exists so the type, measure and
code blocks can be judged before a real post goes in. Posts live in POSTS in
build_site.py; set live to true once one is written.
Body text sits at seventeen pixels on a 1.72 line height, in a column capped near sixty-eight characters. That measure is the whole point: long technical paragraphs stop being readable somewhere past eighty characters, and a disclosure is mostly long technical paragraphs.
A section heading
Headings step down clearly in size rather than relying on weight alone, so the structure of a long writeup survives being skimmed. A reader who lands here from a CVE link is usually skimming for one thing.
Inline code such as X-Forwarded-For gets the pixel face, which keeps it visibly
distinct from body text without shouting.
A sub-heading
- Lists carry steps and enumerations.
- They keep the same measure as the body.
- Nothing in them is decorative.
$ curl -s --path-as-is 'https://host/a/../admin' -i
HTTP/1.1 200 OK
x-served-by: edge
Callouts carry the one sentence that matters — what an attacker actually obtains, not what the endpoint returned.
Closing
The last section of a real post names the fix, the version it shipped in, and the date the vendor pushed it.