How we protect you
- The tool runs in your browser. The checks do not need an account.
- No accounts, storage, cookies, or tracking. Answers are not written to storage and are not sent with the page.
- Consent-first forms through our own relay. The browser posts only to /api/contact. The mailbox is not in the page.
- No third-party scripts. Scripts and styles are files on this site. The print footer is a stylesheet the browser builds for the reference and classification. It is not loaded from another site.
- Offline support caches only site files. The service worker does not cache what you type or a form post.
Protections in place
- Strict Content-Security-Policy on the response, with no unsafe-inline. Scripts are same-origin files. Styles are same-origin files, plus a blob stylesheet used only for the print footer reference and classification.
- HSTS: max-age 63072000, includeSubDomains, preload.
- Permissions-Policy denies camera, microphone, geolocation, payment, USB, and interest-cohort.
- Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy are same-origin.
- X-Frame-Options DENY, and CSP frame-ancestors none on the response header. The meta policy does not repeat frame-ancestors, because a meta element ignores it.
- X-Content-Type-Options nosniff.
- Referrer-Policy strict-origin-when-cross-origin.
- Subresource Integrity (sha384) on local CSS and JavaScript.
- Output escaping. Names and other text you type are written as text, not as HTML.
- CSV and TSV formula-injection guard. A cell that starts with =, +, -, @, a tab, or a carriage return is prefixed with a quote.
- Input limits, and control characters are stripped.
- Honeypot and a three-second wait before the first form submit.
- The repository is private. A release is reviewed before it is published.
How we test
Last run 21 Oct 2026. These rows describe that run. They are not a promise about a later change.
| Tool | What it checks | Last run | Result |
|---|---|---|---|
| OWASP ZAP 2.16.1 | Baseline passive scan | 21 Oct 2026 | Passive baseline completed. Issues from this release are listed below. |
| Nuclei 3.3.7 | Misconfiguration and exposure templates | 21 Oct 2026 | Those templates were run. |
| testssl.sh | TLS | 21 Oct 2026 | Grade A+ |
| Semgrep | JavaScript, XSS, and secrets rules | 21 Oct 2026 | 0 findings |
| Gitleaks 8.21.2 | Secrets in the repository | 21 Oct 2026 | No secrets |
| Lighthouse and axe | Accessibility | 21 Oct 2026 | Accessibility 100. No WCAG 2.2 AA violations. |
Found and fixed (21 Oct 2026)
| Issue | Severity | Status |
|---|---|---|
| Email exposed in page source | Medium | Fixed (server relay) |
| CSP allowed inline scripts and was meta-only | Medium | Fixed |
| CSV formula injection | Medium | Fixed |
| Missing HSTS, Permissions-Policy, COOP/CORP | Low | Fixed |
| Wildcard CORS header | Low | Fixed |
| frame-ancestors ignored in meta | Low | Fixed |
| Cloudflare edge BREACH and LUCKY13 notes, marked potential. The pages do not hold secrets. | Note | Accepted |
Threat model summary
There are no accounts to spoof. The contact form is the only contact route, and the mailbox is not in the source. Pages load only same-origin CSS and JavaScript, with subresource integrity, and user text is not assigned as HTML. A form post is a message you chose to send. The site does not keep a server-side audit log. Initiative names and answers stay in memory for the visit. They are not put in storage, cookies, or the address. Copy tasks leaves the initiative name out. A playbook summary, if you tick the optional box, does not include that name. Form spam is limited by a honeypot, a short wait, length limits, and the same checks on the relay. There is no role to escalate. The service worker caches listed site files only. The notes for models are our own static description, not a channel a visitor can write to. This summary is not a penetration test.
Report a vulnerability
Use the contact form. Include the page, what you saw, and how to reproduce it. Do not include passwords or customer data. The contact file for researchers is /.well-known/security.txt.
Good-faith research that avoids privacy harm, downtime, and other people's data is welcome. We will not take legal action over that research. Please tell us first and give us a reasonable time to fix the issue before you publish details.