# The attack surface you do not have: what changed in v1.1.0, sgit.ai > The changes to the article "The attack surface you do not have" in v1.1.0, paragraph by paragraph. *Source: · sgit.ai v0.7.87 · this file is generated from the same content as the page, so the two cannot drift. Every page on this site has a `.md` twin; internal links below point at them.* --- [Home](../../../index.md) / [Articles](../../index.md) / [The attack surface you do not have](../../the-attack-surface-you-do-not-have.md) / [Versions](../the-attack-surface-you-do-not-have.md) / v1.1.0 # The attack surface you do not have: what changed in v1.1.0 From v1.0.0 (2026-10-21, `783757bc4`) to v1.1.0 (2026-10-21, this release), paragraph by paragraph. 0 paragraphs added, 0 removed, 3 changed in place, 51 unchanged. About 14 words added and 0 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names. [all versions](../the-attack-surface-you-do-not-have.md) 1 unchanged paragraph Summary: Every time I see a CVE now, I smile, because it is one less thing to worry about. My server-side attack surface is very small: fundamentally, the SG/Send upload server, and that only ever stores encrypted data. Today two critical PHP vulnerabilities were released, unauthenticated remote code execution in every supported PHP branch. In the month before, CISA's catalogue of exploited vulnerabilities filled with VPN gateways, mail gateways, firewalls, media servers and a help desk, and WordPress shipped a critical fix. None of it runs in my stack. That is the result of a constraint I have been writing about for months: no database, then no back end, everything that can run in the browser running there. It is good engineering, and it is not a limitation. It is giving me speed: 45 static sites in eleven weeks, a newsroom that can take payments, a100+customerusersprogramme,and customers, a key register, and accounts and an AWS twin on the way, with nothing to provision or patch. Internal applications are where the risk is going, because they are rarely tested like public ones. The question to ask of every component is the one this article ends with: why does this need to be on the server? 31 unchanged paragraphs, under In short {#in-short}, Today, PHP {#php}, A month I did not have to care about {#month}… !shot cv-speed.webp | images/ | The constraint gives speed: 45 live sgit.ai sites, all static, in eleven weeks; 1,306 pages on this newsroom, with a meter and payments; 3100+ users and customers onacrosscustomers.riskmandate.ai;our vaults, sgit.ai and riskmandate.ai; and one server of our own, SG/Send, which stores only ciphertext. | comparison 3 unchanged paragraphs • **[customers.riskmandate.ai](https://customers.riskmandate.ai/)**,**100+ users and customers**, across our vaults, sgit.ai and riskmandate.ai, including [customers.riskmandate.ai](https://customers.riskmandate.ai/), the early-customer programme, with each customer's milestones.programme. 16 unchanged paragraphs, under Where the risk is going {#internal}, The question to ask {#question}, What this does not claim {#limits}… [all versions](../the-attack-surface-you-do-not-have.md) --- *[Site index for agents](../../../llms.txt) · [HTML version](https://newsroom.sgit.ai/articles/versions/the-attack-surface-you-do-not-have/v1.1.0.html)*