Security

Security controls included in this starter and the limitations of static hosting.

1. Transport security

Deploy only on HTTPS. Use the hosting platform's managed TLS. Do not publish an IP address as a substitute for a verified domain or TLS certificate.

2. Browser security headers

The included headers set a restrictive Content Security Policy, HSTS, frame protection, MIME-sniffing protection, referrer policy and limited permissions policy. Review them if you later add a backend or local-engine integration.

3. No secrets in frontend code

Never place API keys, private tokens, passwords or signing secrets in HTML, CSS, JavaScript, source maps or public environment variables. This static release has no secret configuration.

4. Upload and generation controls

There is no public upload endpoint or remote generation endpoint in this release. Before adding either, implement authentication, authorization, validation, file limits, rate limits, secure storage and audit logging.

5. Responsible disclosure

The operator should add a monitored security contact and vulnerability-reporting process before inviting public reports.

6. Hosting boundary

Static hosting providers may process connection logs and operate the infrastructure. No third-party integrations does not mean the hosting provider itself is absent. Review the chosen host's terms.

Last updated: 4 November 2026. This is a starter policy template. The site owner must review it for the laws and actual operation of the deployed service before public launch.