Trust

Security & Responsible Disclosure

We use layered application, platform, and operational controls to protect this website and its administrative tools. Security is continuously maintained; no scan or review can prove that a system is free of every vulnerability.

Engineering practices

Server-side authorization at every privileged route and form-action boundary.
Secure session cookies, password controls, rate limiting, and auditable administrative events.
Strict input limits, contextual output encoding, upload validation, and safe database queries.
Content Security Policy and defensive browser headers.
Separate staging and production data, storage, configuration, and deployment targets.
Dependency, static-analysis, secret-history, dynamic-response, and regression testing.

Our assurance baseline

We use these open standards as practical engineering references:

OWASP ASVS 5.0 Level 2 is our application-security verification target. Full requirement-by-requirement mapping is in progress; we do not claim ASVS certification.
OWASP Top 10 and the MITRE CWE Top 25 inform threat and weakness reviews.
NIST Secure Software Development Framework informs our development and release process. NIST does not publish a canonical “Top 100” web vulnerability checklist.

Current validation snapshot

On 3 September 2026, the repository and staging application completed:

222 automated regression and security tests across 38 test files, all passing.
A package vulnerability audit with no known dependency vulnerabilities reported.
Semgrep static analysis: 365 applicable rules over 199 targets, with no findings or scan errors.
Gitleaks scans of the complete Git history and current release tree, with no findings.
OWASP ZAP passive dynamic analysis: 75 URLs observed, no failing rules, and 12 advisory warning categories reviewed.
Lighthouse accessibility audits: 20 mobile and desktop page states, each scoring 100 with no weighted accessibility failures.
axe-core analysis of the open accessibility panel in default and enhanced display modes at mobile and desktop sizes, with no violations.

This is point-in-time, self-assessed evidence—not an independent penetration test, security certification, or warranty. Findings are remediated and the checks are repeated as the site changes.

Report a security issue

Please use our contact form and identify the message as a security report. Include the affected address, steps to reproduce, and potential impact. Do not access, alter, or download data that does not belong to you, and do not disrupt service while investigating.