Security

• The whole site is served over HTTPS.
• Pages are static, ready-made files; there is no login, no user accounts and no database of visitors on this website.
• Security headers are set on every response (content-type sniffing off, a strict referrer policy, framing limited to our own site and a locked-down permissions policy).
• The contact form talks to our own server, which only accepts requests from this website, limits how often one address can submit, and refuses oversized or malformed input.
• The site loads no third-party scripts, so there is no outside code running in your browser.

• Test only against this website, and use only your own data.
• Don’t run denial-of-service attacks, spam the contact form, or use social engineering against our team.
• Don’t access, change or share anyone else’s information. Stop and tell us if you come across any.
• Give us reasonable time to fix the problem before you share details publicly.

We’ll read every report, tell you what we find and fix real issues as quickly as we can. We don’t run a paid bounty programme, but we’re glad to credit you if you’d like.