HD Cyber Defence AI security • practical resilience

Secure by design

A smaller attack surface. Clearer trust boundaries.

The production build is intentionally self-contained and read-only: no CMS, database, public login, upload function, analytics platform or server-side contact form.

Website security architecture

  • Local PHP components generate shared page structure and response headers.
  • Local CSS, JavaScript, SVG and image assets; no CDN or third-party runtime code.
  • Restrictive Content Security Policy, frame protection, MIME-sniffing protection and browser permissions policy.
  • HTTPS enforcement and HSTS when served through the production HTTPS origin.
  • Directory listing disabled and direct access to internal include files blocked.
  • Only read-only HTTP methods are accepted by the public web root.
  • The maturity simulator processes and stores answers in the visitor’s browser only.

Responsible vulnerability reporting

For a suspected vulnerability affecting this website, send a concise description, affected URL, safe reproduction steps and potential impact. Do not access data that is not yours, disrupt service, use destructive payloads or publicly disclose an issue before reasonable remediation time.

Report securely by email View security.txt

Important hosting boundary

A clean website release cannot prove the entire hosting account is malware-free. Old folders, control-panel accounts, cron jobs, email accounts, DNS settings, hidden configuration files or unrelated applications must be reviewed separately before deployment.