ᚲ.com

Static security architecture

Security

Direct answer

The release disables Passenger, denies directory listings and protected source paths, uses local executable assets only, ships a strict Content Security Policy, and requires HTTPS with the canonical ACE host. It contains no database, server application, analytics, remote script, or writable API.

Stable record
K01-PAGE-SECURITY
Claim status
VERIFIED PROJECT IMPLEMENTATION
Last reviewed
Research cutoff
Source type
GOVERNED PROJECT KNOWLEDGE
Currentness
Current for release 2.1.0; external sources require periodic revalidation.
Correction state
No unresolved public correction recorded for this release.
Machine record
Static JSON record

Controls

  • Apache security headers, frame restrictions, MIME controls, and referrer policy.
  • Hashed CSS, JavaScript, and primary media assets.
  • No inline event handlers, eval, remote executable dependencies, or third-party fonts.
  • Protected memory, source, tests, and raw reports excluded from the public ZIP.
  • Deterministic archive, safe-path, duplicate-entry, extraction, and checksum verification.

Residual risk

Static packaging does not verify the host’s TLS, Apache modules, filesystem permissions, account security, backups, DNS, compromise state, or future modifications. Live deployment requires independent observation.