Security
Security is a starting requirement for everything we build, including this website. Here is how this site protects the people who visit it.
How this website is built.
Static by design
Every page is generated ahead of time as plain HTML. The only code that runs on a server is a small function that checks and delivers messages from the contact and support forms. There is no database or login on this site.
Content Security Policy
Each page declares exactly which scripts and stylesheets may run, identified by cryptographic hash. Anything else is refused by the browser.
HTTPS only
The site is served over HTTPS, and Strict Transport Security tells browsers never to connect over an unencrypted connection.
No tracking
This site sets no cookies and loads no advertising or tracking scripts. Visits are counted with Cloudflare Web Analytics, which sets no cookies and does not identify visitors. Cloudflare Turnstile, on the contact and support pages, keeps the forms free of spam. The typeface is hosted on the same domain as the pages.
Hardened headers
Response headers stop other sites from framing these pages, prevent browsers from guessing content types and switch off device features such as the camera and microphone.
Small, reviewed dependencies
Third-party code is limited to a short list of widely used open source libraries, checked for known vulnerabilities before each release.
Reporting a vulnerability.
If you believe you have found a security issue on this site, please tell us through our support form. Please include enough detail to reproduce the issue, and give us a reasonable time to fix it before sharing it publicly.
Accessible by default.
Security and accessibility both come down to respecting the people who use what we build.