Trust
This page explains how this site is built, so it can be verified rather than taken on trust.
No trackers
This site uses no cookies, no analytics, no advertising and no third-party scripts. Every file is served from dekryptsecurity.com. Details are on the privacy page.
Security headers
Every page is served with the headers below. The table is generated from the site's _headers file when the site is built, so it always matches what is deployed.
You can check them yourself in your browser's developer tools, under the Network tab.
Few dependencies
The site is built by a small Python script using only the standard library. Nothing from npm or pip is shipped to your browser. Fonts are self-hosted and icons are inline SVG.
Reporting a vulnerability
If you find a security issue in this site or in something I built, email security@dekryptsecurity.com. I acknowledge reports within 3 business days.
- Please allow reasonable time to fix the issue before publishing details.
- Don't access more data than you need to show the issue, and don't disrupt the service.
- There is no bounty programme.
Contact details are also in /.well-known/security.txt, published per RFC 9116.
No PGP key is published; use the addresses above.
| Path | Header | Value |
|---|---|---|
/* | Content-Security-Policy | default-src 'self'; img-src 'self' data:; font-src 'self'; style-src 'self'; script-src 'self'; connect-src 'self'; base-uri 'none'; object-src 'none'; form-action 'self'; frame-ancestors 'none'; worker-src 'self' |
/* | X-Content-Type-Options | nosniff |
/* | X-Frame-Options | DENY |
/* | Referrer-Policy | strict-origin-when-cross-origin |
/* | Permissions-Policy | camera=(), microphone=(), geolocation=(), payment=() |
/* | Strict-Transport-Security | max-age=31536000; includeSubDomains |
/* | Cross-Origin-Opener-Policy | same-origin |
/* | Cache-Control | no-cache |
/assets/css/* | Cache-Control | public, max-age=31536000, immutable |
/assets/js/* | Cache-Control | public, max-age=31536000, immutable |
/assets/fonts/* | Cache-Control | public, max-age=31536000, immutable |
/.well-known/security.txt | Content-Type | text/plain; charset=utf-8 |
/.well-known/security.txt | Cache-Control | public, max-age=3600 |
/assets/fx/* | Cache-Control | public, max-age=31536000, immutable |
For technical readers
Measured, not claimed. The numbers come from the build; the live rows are measured in your browser.
- Pages
- 25
- Tools
- 7
- Posts
- 4
- JavaScript dependencies shipped
- 0
- Total site weight
- 2134 KB across 106 files
- Tests
- 291 checks passing, 0 failing (14 Oct 2026)
- Third-party requests on this page
- measured with JavaScript
- Cookies on this page
- measured with JavaScript
| Header | Value |
|---|---|
| content-security-policy | default-src 'self'; img-src 'self' data:; font-src 'self'; style-src 'self'; script-src 'self'; connect-src 'self'; base-uri 'none'; object-src 'none'; form-action 'self'; frame-ancestors 'none'; worker-src 'self' |
| strict-transport-security | max-age=31536000; includeSubDomains |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=(), payment=() |
| cross-origin-opener-policy | same-origin |
Disclosure policy
If you find a security problem in this site or in software I publish, email security@dekryptsecurity.com with steps to reproduce. Machine-readable details are in security.txt.
- Test only what you need to show the problem. Do not access other people's data, degrade the service, or send spam through the forms.
- Allow reasonable time to fix it before you publish details.
- I aim to acknowledge reports within 3 business days, keep you updated, and credit you if you wish. There is no paid bug bounty.