Security

This site is built security first. These are the controls that ship with the code, so you can check them yourself in the response headers and the repository.

What is in place

• Strict Content Security Policy

  Scripts run only from this site. Inline scripts are allowed by hash, never by blanket 'unsafe-inline'. Framing, plugins and foreign form targets are blocked.

• Hardened transport and headers

  HSTS with preload, no MIME sniffing, no framing, a strict referrer policy, cross-origin isolation headers, and a Permissions-Policy that switches off sensors, camera, microphone and payment APIs.

• No tracking, no cookies

  No analytics, no third-party trackers, no cookies. There is nothing to consent to and nothing to leak.

• Static by default

  Pages are pre-built static files served from Cloudflare's edge. There is no database, no user account and no server code to attack: no forms, no API.

• Infrastructure as code

  The domain, DNS, TLS, DNSSEC and firewall settings are defined in Terraform in the repository. Changes are planned on a pull request and applied only after review, so the edge configuration is reviewable and reproducible.

• Supply chain

  The site ships no third-party runtime scripts. Dependencies are watched by Dependabot, scanned with CodeQL and npm audit in CI, and every change is built and tested before deploy.

Report a vulnerability