How we secure ourselves

Last updated: October 23, 2026

We sell security, so our own site is evidence. You can check most of this page yourself: open your browser’s developer tools on any page and look at the response headers and the network tab.

This website

Our site is static HTML. The only server code is three small functions: one receives contact-form messages, one deletes old records on schedule, and one is switched off and answers every request with “not found”. There’s no login. There’s no database behind the pages.
It doesn’t run PHP. That’s not because PHP is bad; a brochure site simply doesn’t need server code. For some customers’ marketing sites, we’ll suggest the same.
Nothing from other companies’ servers. No trackers, ad pixels, chat widgets or embedded videos. Fonts and every other file come from our own domain. The one script we didn’t write is our hosting provider’s visit counter (Vercel Web Analytics), served from our domain too: it counts page views with no cookies, no cross-site tracking and no profiles, and sends them only to our own domain.
Almost no JavaScript. A few small scripts of our own fill in the end-of-life day count and the copy buttons. Every page reads correctly with JavaScript turned off.
Forms post only to us. The contact form sends a plain HTML form to our own function. We don’t store your IP address with your message, and the form asks you never to include passwords or keys.

The headers we send

These are copied from our hosting configuration when the site is built, so they match what your browser receives.

Content Security Policy

Deny by default, then allow only our own files. No inline scripts or styles, and Trusted Types are enforced.

default-src 'none'
script-src 'self'
style-src 'self'
img-src 'self'
font-src 'self'
media-src 'self'
connect-src 'self'
form-action 'self'
frame-ancestors 'none'
base-uri 'none'
object-src 'none'
require-trusted-types-for 'script'
trusted-types 'none'

Other security headers on every response
Header	Value
`Strict-Transport-Security`	`max-age=63072000; includeSubDomains`
`X-Content-Type-Options`	`nosniff`
`Referrer-Policy`	`same-origin`
`Permissions-Policy`	`accelerometer=(), autoplay=(), browsing-topics=(), camera=(), clipboard-read=(), display-capture=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(), hid=(), identity-credentials-get=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-create=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), xr-spatial-tracking=()`
`Cross-Origin-Opener-Policy`	`same-origin`
`Cross-Origin-Resource-Policy`	`same-origin`
`Cross-Origin-Embedder-Policy`	`require-corp`
`Origin-Agent-Cluster`	`?1`
`X-Frame-Options`	`DENY`
`X-Permitted-Cross-Domain-Policies`	`none`
`X-DNS-Prefetch-Control`	`off`
`Access-Control-Allow-Origin`	`https://oakshield.co`

How we build it

Pinned, reviewed dependencies. Every direct dependency is pinned to an exact version, and installs use a locked dependency tree.
A seven-day waiting period. We don’t install any package version that’s less than a week old, which gives the community time to catch and pull malicious releases.
No install scripts. Dependency install scripts are blocked unless we’ve reviewed them.
Machine-checked rules. Every build fails if a page gains an inline script or style, a third-party resource, or anything that looks like a secret. Source code is scanned for hidden or direction-changing Unicode characters.
No secrets in the browser. Pages never read secrets, so none can end up in the HTML.

Responsible disclosure

Responsible disclosure: security researchers can reach us at security@oakshield.co. The same contact is published in machine-readable form at /.well-known/security.txt.