Visible safeguards
Restrictive CSP with default-src none, hardened HTTP headers, server-side validation, CSRF protection, rate limiting, hardened administration sessions and no-store caching for sensitive areas.
Security
Secure by default, responsible disclosure
Kerkenniens deliberately limits its technical surface: no public CMS, no CDN, no remote JavaScript library and a private administration interface separated from public navigation.
Minimal data
The public form does not add an IP address or browser fingerprint to the application message. Configuration secrets are expected outside public code.
Report a vulnerability
For a security report, use the channel provided in security.txt. Do not publicly disclose exploitable detail before the issue can be reviewed.
security.txt →Scope
This page describes design safeguards. It is neither a certification nor a guarantee that no vulnerability exists. External audit results are stated only when actually measured.
Acknowledgments
Responsible reports that materially improve the project’s security may be publicly acknowledged with the reporter’s explicit consent. No name is published without consent.