Add Series Three: Security Professionals (50 cards)

[ralyodio]

Adds a third collection at /security-professionals, built the same way Series Two was: a hand-curated data module plus a roster page, art to follow.

The set

50 cards for the defensive side of the field, ordered by set number:

• Cryptography — Diffie, Hellman, Rivest, Shamir, Adleman, Zimmermann, Schneier, Kocher, Matthew Green, Nadia Heninger
• Academic pillars — Dorothy Denning (the 1987 intrusion-detection model), Spafford, Ross Anderson, Matt Blaze, Radia Perlman, Bellovin
• Defensive tooling — Cheswick, Ranum, Venema, Farmer, Fyodor, Roesch, Combs, Vixie, Deraison, Provos, Ristić
• Application security — Jeremiah Grossman (WhiteHat, WASC, and the XSS book), RSnake, Curphey, Jeff Williams, McGraw, Michael Howard, Shostack
• Vulnerability research — Mark Dowd, Halvar Flake, Sotirov, Ptacek
• Leadership and response — Window Snyder, Heather Adkins, Parisa Tabriz, Alex Stamos, Dan Geer, Kevin Mandia, Mikko Hyppönen, Robert M. Lee, Lesley Carhart, Katie Nickels, J. Alex Halderman, Troy Hunt

Every entry carries at least two public sources for the claims in its scouting report. Nobody appears in more than one series — Series Two already holds Mudge, Kaminsky, Moussouris, Wysopal, Rutkowska, HD Moore, Zalewski and the rest, so none of them are repeated here.

Series Three uses a different stat block than Series Two: notoriety is the wrong axis for people whose careers were spent keeping their names out of the news, so the four bars are technical / defense / research / influence.

Mechanics

• New src/data/roster.ts holds the card vocabulary both hand-curated series share (Rarity, Status, Source, the fields RosterCard reads, and the label maps). hacking.ts extends it instead of redeclaring it — no behaviour change to Series Two.
• RosterCard now takes entry + basePath so it renders any series. An entry with no rendered front no longer links anywhere, because card pages only exist once art does.
• No art pipeline for Series Three yet, so it ships as a roster page only and contributes just its index page to the sitemap.
• Nav, home-page teaser, sitemap, README and the /contribute card spec updated.

Verified

• npx tsc --noEmit clean
• pnpm build clean; /security-professionals prerenders, 165 static pages total
• Data checks: 50 unique slugs, numbers 1-50 contiguous, zero overlap with Series One or Two, minimum 2 sources per card

pnpm lint fails on this branch and on main — next lint was removed in Next 16 and the script was not updated. Left alone as out of scope.

🤖 Generated with Claude Code

https://claude.ai/code/session_014htrUgbnoKQt9iT4G7hUpy

[github-actions]

ThreatCrush Security Scan

3 finding(s)

MEDIUM: 3

Severity	Rule	Location
MEDIUM	js-credential-logged	scripts/migrate.mjs:16
MEDIUM	js-unescaped-html-sink	src/app/cards/[slug]/page.tsx:60
MEDIUM	js-unescaped-html-sink	src/app/hacking-legends/[slug]/page.tsx:68

Snippets are redacted; ThreatCrush never prints matched credential material.