Security practices

Transport

HTTPS everywhere, TLS 1.2 minimum with TLS 1.3 preferred, HSTS with a one-year max-age, includeSubDomains and preload. HTTP is redirected, never served.

Browser security headers

Content-Security-Policy restricting scripts, styles, fonts, connections and frames to an explicit allow-list. X-Content-Type-Options: nosniff. Referrer-Policy: strict-origin-when-cross-origin. X-Frame-Options: DENY and frame-ancestors none. Permissions-Policy denying the sensor and payment APIs the site does not use. Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy set to isolate the origin.

Secrets

No secret is committed. Runtime secrets are Cloudflare Worker secrets, injected at the edge and never readable from a deployment log. The repository is scanned for accidentally committed credentials on every push.

Data

Encrypted in transit by TLS and at rest by the storage platform. Personal information collected through the site is limited to what a form genuinely needs, retained on a stated schedule, and deleted on request.

Disclosure

Report a vulnerability to [email protected]. The machine-readable policy is at /.well-known/security.txt. We acknowledge within two business days, we do not threaten researchers who act in good faith, and we pay for findings through the public bounty board.

Sources

Where this page states a standard, an obligation or a research result, this is what it is drawn from. All external, all checkable.

1. RFC 9116 — A File Format to Aid in Security Vulnerability Disclosure — the security.txt standard
2. OWASP Top 10 — the risk categories the review covers
3. OWASP Application Security Verification Standard — the checklist a review is measured against
4. Content Security Policy Level 3 — W3C
5. RFC 6797 — HTTP Strict Transport Security — IETF
6. SARIF 2.1.0 — OASIS — the format Unslop emits

Other documents