Security
Small surface, explicit boundaries
This site is static. That removes whole classes of risk: there is no application runtime, no database and no session state to attack.
What this site does
- Serves pre-built HTML, CSS, JavaScript and SVG files.
- Sets a restrictive set of response headers at the web server.
- Returns a dedicated 404 document for unknown paths.
- Refuses requests for dotfiles.
What this site never does
- Collects or transmits credentials. The demo form is client-side only.
- Loads scripts, fonts, images or styles from third-party origins.
- Sets cookies, uses local storage or includes analytics.
- Exposes administrative endpoints.
Around the site
Public traffic is terminated by one reverse proxy. Administrative ports of the other services are not published to the host at all. Backend service names resolve only on internal Docker networks. Secrets are kept in mode-restricted files and are excluded from version control.