Security begins with boundaries.
A transparent view of the measures in the website and the limits of the current product concept.
Website protection
Form endpoints enforce basic input validation, body-size limits, origin checks, rate limiting, and bot-trap fields. Responses use restrictive browser security headers. Subscriber and contact data are stored server-side, not in frontend JavaScript.
Important limits
Rate limiting is in-memory per server process in this build, and local SQLite storage needs a persistent disk and appropriate backups. Large-scale or horizontally distributed deployment requires managed shared storage, distributed rate limiting, monitoring, and operational review.
Verification architecture
The interactive demonstration does not attest to identity or human presence. Any future trust service must be independently threat-modeled, implemented, audited, and tested before it can be used for security decisions.
Responsible disclosure
If you discover a security problem, explain it through our contact form without sending exploit payloads or personal information from other users.