This repository is a static marketing site. It has no server, database, accounts or form processing, and it makes no third-party requests, so the attack surface is small. Relevant concerns are things like supply-chain risk in the GitHub Actions workflows, content injection through contributed changes, and accidentally committed secrets.

Please do not open a public issue for a security problem.

Report it privately through GitHub: open the repository's Security tab and choose Report a vulnerability. Include what you found, how to reproduce it and the impact you expect.

You can expect an acknowledgement within a few days. Once a fix is available it will be published and, where appropriate, credited to you.

• GitHub Actions are pinned to full commit SHAs, and build and test tooling to exact versions in package-lock.json (installed with npm ci); Dependabot proposes updates weekly.
• The site deploys only after every CI check passes, and the deployed files are the exact build the checks ran against.
• Workflows use least-privilege permissions.
• The published artifact contains only the built site files (see scripts/stage.cjs), not the repository.
• Published pages carry a Content-Security-Policy (<meta> tag, as GitHub Pages cannot set headers): scripts, styles, fonts and images load only from the site itself, inline blocks are allowed by SHA-256 hash, and plugins and form submissions are disabled. CI fails if anything on the page violates it.
• Fonts are self-hosted and there are no analytics, trackers or cookies.
• Pages may be framed (a <meta> CSP cannot set frame-ancestors), which the embeddable calculators rely on. There are no accounts, forms or actions to hijack. In embed mode a page only posts its own height to the parent; the published snippet accepts that message only from this site's origin and only for the iframe that sent it.
• The service worker (published build only) handles same-origin GET requests inside the site's own path, caches only the site's files, and is network first; it never caches responses for URLs carrying calculator numbers.
• .gitignore excludes local tooling output.