Security

Last updated October 21, 2026.

What there is to protect

This site stores no visitor data, has no accounts and runs no database for the public pages. The attack surface is the pages themselves and the hosting account.

Controls in place

• All traffic is encrypted in transit with TLS; HTTP Strict Transport Security is set for two years with preload.
• A content security policy restricts scripts, styles, fonts and images to this site's own origin.
• Clickjacking, MIME-sniffing and referrer leakage are blocked by response headers on every page.
• Hosting is on SOC 2 Type II certified cloud infrastructure with a web application firewall and DDoS protection at the edge.
• The site is deployed from version control through a scripted pipeline that runs automated checks before anything goes live.
• An independent monitor loads the public pages every 15 minutes from outside the site and alerts a person if a page fails. Current state is on the status page.

Reporting a vulnerability

If you find a security problem, email haitianflagdaynj@gmail.com with enough detail to reproduce it. Please give us a reasonable time to fix it before publishing, and do not access data that is not yours. We'll acknowledge it as soon as a volunteer reads it, and credit you on the acknowledgements page if you wish. Machine-readable contact details are at /.well-known/security.txt.