Security

Last updated 4 September 2026

This is a small site with one form. That is deliberate: the less it holds, the less there is to lose.

What is actually here

• Static pages plus one endpoint that turns the order form into an email.
• No database, no accounts, no sessions, no payment surface.
• No third-party scripts other than the web font stylesheet.

How it is protected

• HTTPS everywhere, with HSTS.
• A content security policy, X-Content-Type-Options, X-Frame-Options and a referrer policy set at the edge.
• Every field on the order endpoint is length-checked and validated server side. Malformed payloads are rejected with a 400.
• Errors return a code, never a stack trace.
• Mail credentials live in a separate internal service reached over a service binding, so no key is held in this project.

Reporting a vulnerability

Email security@bongoupeyi.com. Tell us what you found and how to reproduce it. We will acknowledge within five working days.

Please do not run automated scanners against the site, do not access or modify data that is not yours, and give us a reasonable window to fix an issue before publishing it. Do that and we will not pursue you.

Machine-readable policy: /.well-known/security.txt. Researchers we have thanked: /security/thanks.