How we protect this site

The technical measures used to build and protect ofsec.org. You can verify most of them yourself.

Last updated:

We apply to our own website the measures we recommend to our clients. Most of them can be verified publicly.

Architecture

  • The site is a single compiled Go program with its content built in. The only data it writes is sign-ups for the checklist and the newsletter, stored in a database on the same server that is reachable only locally, with no password on the network.
  • There is no content management system, no admin panel and no plugins, so nothing can be compromised through them.
  • The program runs with restricted permissions in an isolated environment of the operating system.

Protection in transit

  • The server accepts requests only from the Cloudflare network. The connection between Cloudflare and the server is encrypted and authenticated with a certificate.
  • All connections use HTTPS, and browsers are instructed never to use an unencrypted connection (HSTS).

Protection in the browser

  • The Content Security Policy forbids loading scripts, styles and fonts from other sites, as well as inline code in the pages.
  • The site uses no cookies, tracking scripts or external services.
  • The pages cannot be embedded in other sites, and the browser is instructed not to send unnecessary information to other sites.

Forms

  • All data is validated on the server: required fields, length, and the format of the email and company ID.
  • Attachments are accepted only as PNG, JPG, PDF, TXT or EML files of limited size, and their content is checked against the file type.
  • The number of requests from one address is limited, and automated submissions are rejected.
  • Sign-ups are confirmed by email (double opt-in), and the confirmation email contains no text typed by the visitor, so the forms cannot be used to send spam.

Email

  • The domain has SPF, DKIM and DMARC records with a p=reject policy: receiving servers reject emails not sent by our servers.
  • The address for vulnerability reports is published in /.well-known/security.txt.

Check it yourself

The site's security headers can be checked with tools such as Mozilla Observatory and securityheaders.com. If you find a problem, please report it under our vulnerability disclosure policy.