This site
How logveil.com is built and served
This page describes the security posture of the website itself — not of the product, which is in development and described on its own pages. Everything here can be checked from the outside: the headers a response carries, the origins a page loads from, the file at the well-known address.
The headers every response carries
Set at the edge for every path, the documents on the resources page included. The names are the standard ones; what each does, in words:
- Content-Security-Policy
- Every source is denied by default. Scripts, styles, images, fonts and connections are allowed from this site alone, with two exceptions: the one inline script that applies your theme before the first paint and the inlined stylesheet, each admitted by its own hash and never by a blanket allowance; and the form service the early-access form posts to, named as the only permitted connection and form target. Nothing may frame these pages, and no plug-in may load.
- Strict-Transport-Security
- Browsers are told to use encrypted connections to this site, and to every subdomain of it, for two years, and the domain is submitted for preloading so that even the first visit is encrypted.
- X-Content-Type-Options
- A browser may not guess a file's type; it uses the declared one.
- X-Frame-Options
- No other site may embed these pages in a frame.
- Referrer-Policy
- When you follow a link away from this site, the page you came from is sent only as this site's origin, never the full address.
- Permissions-Policy
- The browser features a page could ask for — camera, microphone, location, motion sensors, payment, USB — are switched off for these pages.
- Cross-Origin-Opener-Policy
- A page opened from another site cannot keep a handle on this one.
What the pages load
No cookies. No analytics. No advertising. No font, script, image or style from another domain: the two typefaces are subset and served from this site, and every visual is drawn by code. The one outside service is the early-access form's delivery (Formspree, in the United States); the privacy notice says what it receives and why. Nothing else on this site talks to anything else. The privacy notice.
The well-known security file
The file at the well-known address follows the standard for it (RFC 9116): a contact address, an expiry date (1 September 2027), the language we read, and the canonical location of the file. The file itself.
How to report a problem with this site
Write to [email protected]. We read every report. We do not run a bounty programme and we do not promise a response time; we will answer. Please do not test the early-access form with automated tools: it delivers to a real mailbox.
What the build refuses to deploy
Every deployment is built from source and passes a set of checks before it can be served: the words on every page against the approved claims, every origin a page references, every inline script and style against the policy above, the page count against the route inventory, the fonts against their subsets, and every document on the resources page against its recorded text. A build that fails any of them is not deployed.
Not the product
The product's own posture — the offline kit, zero egress, hardening, what Zindagi never receives — is on the deployment page, and it is in development.