No third-party requests
Every asset is served from this domain. No CDN, no external fonts, no analytics, no tag manager, no chat widget. Visiting this page tells no other company that you were here.
Our own security posture
It would be strange to sell security testing and run a sloppy website. This page documents how this site is built and how client data is handled, so you can check rather than take our word for it.
This website
How this site is built
All of this is externally verifiable — check the response headers yourself.
Strict Content-Security-Policy
script-src and style-src are set to 'self' with no unsafe-inline. There are no inline scripts or styles anywhere on the site, so an injected one would be blocked by the browser.
Transport security
TLS 1.2 and 1.3 only, HSTS with a two-year max-age and preload, and HTTP permanently redirected to HTTPS.
Static by design
The site is static HTML. There is no database, no CMS and no admin panel, which removes the majority of the attack surface a marketing site normally carries.
Minimal attack surface
The server exposes only SSH, HTTP and HTTPS. Unused services are not running, and the firewall is default-deny.
Contact form
Submissions are relayed straight to our inbox over authenticated TLS and are never written to a database on the server. The relay is a dependency-free service running unprivileged under a hardened systemd unit.
How we handle your data during an engagement
- NDA signed before any scope detail is exchanged
- Credentials and test accounts held only for the engagement duration
- Findings and evidence stored encrypted, and shared only over channels you approve
- Real customer data is never exfiltrated — evidence is a screenshot, not a copy
- All engagement artefacts destroyed on request at the end of the work
- Reports delivered directly to named recipients you nominate
- No client name, logo or detail published without your written permission
- No client data used to train any machine learning system
Reporting a vulnerability in our systems
We publish a disclosure policy at /.well-known/security.txt in the RFC 9116 format. Good-faith research is authorised and we will not pursue legal action against researchers who follow it.
Report to kalkii@abhinavcybersecurity.online or through HackerOne. Please include reproduction steps and, where relevant, a proof of concept.
Please do not run automated scanners at volume, access data that is not yours, or degrade availability for others. We do not currently pay bounties for findings on our own infrastructure, and we will say so honestly rather than implying otherwise — but we will credit you publicly if you would like us to.
Next step
Found something? Tell us.
We do not pursue legal action against researchers acting in good faith. Report anything you find and we will respond.