Security Policy

Technical hardening details and security posture of this site

Security is part of the build — not an afterthought. This page documents the specific controls in place on this site.

01 Transport Security

  • HTTPS — public site traffic is encrypted in transit.
  • HSTS — Strict-Transport-Security is sent on HTTPS responses so supporting browsers prefer HTTPS.
  • HTTP → HTTPS redirect — all port-80 traffic receives a 301 redirect to the HTTPS equivalent.
  • Certificate: Let's Encrypt — auto-renewed, with zero-downtime reload on renewal.

02 HTTP Security Headers

Header Purpose
Content-Security-Policy Restricts content origins and helps mitigate content-injection attacks
Strict-Transport-Security Forces HTTPS
X-Frame-Options Prevents clickjacking via iframe embedding
Permissions-Policy Disables browser APIs unused by this site
X-Content-Type-Options Prevents MIME-type sniffing attacks
Referrer-Policy Limits referrer leakage to external sites

03 Application Layer

  • CSRF protection — POST forms use server-generated CSRF tokens.
  • Input validation — contact form input is validated server-side before persistence.
  • Spam controls — the contact form uses a honeypot and per-source rate limiting.
  • Debug mode off in production — stack traces are never exposed to end users.
  • Secret key — stored as an environment variable; not present in the codebase or version history.
  • Admin access — requires authenticated staff access, sends explicit anti-indexing headers, and throttles repeated failed login attempts.

04 Infrastructure

  • Server: Linux VPS with automatic security patching enabled.
  • Process: Application server runs as a non-root user with resource limits.
  • Static files: Served directly by the web server — the application layer never handles static asset requests.
  • Logs: Access logs rotated regularly; error logs monitored for anomalies.
  • Firewall: Network access is restricted to necessary services only.

05 Dependency Management

  • Dependencies are pinned and version-controlled.
  • Site JavaScript is self-hosted; Google Analytics is the only third-party script.

06 Reporting a Vulnerability

If you find a security issue on this site, please report it responsibly. See the Responsible Disclosure page for the process.

Privacy Policy → Responsible Disclosure →