How this site is secured.
Everything below is checkable. Open your browser's network tab, or run this domain through securityheaders.com, and compare it against what this page claims.
What this site does not do.
No JavaScript
The public site ships zero JavaScript files. There is no client-side code to compromise.
No third-party requests
Fonts are self-hosted. No CDN, no analytics, no tag manager, no embedded widgets. Your browser talks only to this domain.
No cookies, no tracking
The site sets no cookies and there is no analytics of any kind, so there is no consent banner to dismiss.
No accounts
The public site stores nothing about you because it collects nothing.
Every header, and why it's set.
Strict-Transport-Security
max-age=63072000; includeSubDomains
Browsers refuse to load this site over plain HTTP for two years after the first visit.
Content-Security-Policy
default-src 'none' + per-file hashes
Nothing loads unless it is explicitly allowed. Every inline block is allowed by its SHA-256 hash, not by a blanket exception.
X-Content-Type-Options
nosniff
Stops the browser guessing a file is something other than what we served.
Referrer-Policy
strict-origin-when-cross-origin
Other sites see that you came from here, never which page you were on.
Permissions-Policy
camera, microphone, geolocation, payment, usb, bluetooth all denied
This site has no reason to touch any of them, so it gives up the right to.
X-Frame-Options
DENY
The site cannot be loaded inside a frame on another site, which blocks clickjacking.
Cross-Origin-Opener-Policy
same-origin
Isolates this page from any window that opens it or that it opens.
Found a problem?
If you find a security issue in this site or in any SafeWorld product, tell us before telling anyone else and we will fix it and credit you. There is no bounty — this is a small studio — but there is a fast reply and honest credit.