Security

This page describes the public website. It does not describe the security of Perspicora’s newsroom systems.

What the site does

The site is static HTML and CSS, with almost no client-side script. Security headers include a content security policy, a referrer policy, a permissions policy, and nosniff. Pages are not framed by other sites. HTTPS strict transport security is sent only when the site is actually served on the canonical host over HTTPS.

Dependencies are pinned with a lockfile and reviewed in continuous integration. Third-party marketing scripts are not loaded. Fonts are self-hosted. Secrets are not stored in the repository.

The contact form checks the origin of the submission, limits size and content, and does not create an account. Messages go only to an intake channel configured on the host.

What is not claimed

No security certification, audit badge, or bug-bounty program is claimed. No security officer is named, because no such appointment is confirmed. Hosting details are not stated here while the live host is unconfirmed.

Reporting a problem

Use the contact form and choose Security. Describe the page and what you observed. Do not include other people’s personal data. Do not include an exploit that would harm the site or its readers. Give a way to reply.

The group will acknowledge security reports under the same five-business-day standard as other complaints, and will fix confirmed problems in the site. There is no public payment for reports.