What is actually enforced

Response headers

Sent on every route, configured in one place so no page can opt out of them.

Content-Security-Policy

Scripts, styles, fonts, images and connections are restricted to this origin, with a narrow allowance for the bot-verification provider. Violations are posted back to /api/csp-report.

X-Frame-Options

The site cannot be framed, which removes clickjacking as a delivery route. frame-ancestors 'none' in the policy above says the same thing to newer browsers.

X-Content-Type-Options

The browser honours the declared content type instead of guessing, so a response cannot be reinterpreted as a script.

Referrer-Policy

Outbound requests carry the origin but never the full path, so internal URLs are not leaked to third parties.

Permissions-Policy

Camera, microphone, geolocation, payment, USB and interest-group topics are switched off for this document and anything it embeds.

Cross-Origin-Opener-Policy

The browsing context is isolated from cross-origin windows that would otherwise hold a reference to it.

Application controls

Request boundary

Strict request-size and JSON parsing limits, origin and content-type enforcement, explicit trusted-proxy configuration, and Cloudflare Turnstile on the public intake.

Rate limiting and identity

Atomic rate limiting with keyed hashing of IP and user agent, so a limiter key cannot be reversed into the address that produced it.

Durable intake

Inquiries land in a queue protected by row-level security, written with a server-only service role that is never exposed to the browser.

Outbound delivery

Signed, versioned, idempotent webhooks over an HTTPS allowlist, with private-network addresses and redirects refused. Retries carry leases and jitter; exhausted work goes to a dead-letter path with an alert rather than disappearing.

Administrative access

HttpOnly, Secure, SameSite sessions. Session, hash, admin and cron secrets rotate independently, and sessions are invalidated on compromise.

Data retention

A scheduled purge removes stored intake records on a retention schedule rather than accumulating them indefinitely.

Telemetry

Disabled by default and gated behind explicit consent. Nothing is collected from a visitor who has not opted in.

Release gates

A release runs the full verification pipeline. A failing gate stops the release rather than being recorded as a warning.

Secret scanning

A dedicated workflow scans the repository, and a full-history scan with a clean result is required before an incident can be closed or a promotion can proceed.

Static analysis

CodeQL runs against the codebase on the integration workflow.

Dependency policy

The build fails on a high-severity advisory, a software bill of materials is generated on every release run, and a scheduled job refreshes the security lockfile.

Content and contrast

Unapproved placeholder claims fail the build, and a contrast gate measures rendered pixels on every published route against the WCAG 1.4.3 AA threshold rather than trusting a static palette.

Reporting a vulnerability

Report suspected vulnerabilities privately to hello@closedlab.com. Do not include production secrets, customer data or exploit payloads in a public issue.

Receipt is confirmed privately, evidence is preserved, severity is assigned, and any exposed credential is rotated immediately. Only the latest production branch that has passed every release gate is supported.